git: c006c8dac0e5 - main - if_bridge: Fix NULL softc dereference in bridge_input()

The branch main has been updated by pouria:

URL: https://cgit.FreeBSD.org/src/commit/?id=c006c8dac0e5de354c48e3b5fc2bce4e0e6f5152

commit c006c8dac0e5de354c48e3b5fc2bce4e0e6f5152
Author:     Aaron Espinoza <acesp25@freebsd.org>
AuthorDate: 2026-08-29 03:16:35 +0000
Commit:     Pouria Mousavizadeh Tehrani <pouria@FreeBSD.org>
CommitDate: 2026-08-30 18:04:18 +0000

    if_bridge: Fix NULL softc dereference in bridge_input()
    
    In bridge_input, sc is initialized to NULL and doesn't get
    resolved until after the Ethernet header pullup.
    So the pullup's failure path ends up dereferencing the NULL sc
    when bumping up IFCOUNTER_IERRORS.
    
    The m_freem call right under it is redundant as the failure path in
    m_pullup already freed the chain.
    
    Drop both lines, matching what we have in bridge_output.
    
    ether_input_internal() discards frames shorter than ETHER_HDR_LEN
    before the bridge hook, so it is unlikely that it will fire.
    We still keep the guard as lagg(4) and ng_ether(4) may replace
    the mbuf before the bridge hook.
    
    Signed-off-by:  Aaron Espinoza <acesp25@freebsd.org>
    Reviewed by:    pouria
    Pull Request:   https://github.com/freebsd/freebsd-src/pull/2393
---
 sys/net/if_bridge.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/sys/net/if_bridge.c b/sys/net/if_bridge.c
index 792b2c952e7a..ef7101f13224 100644
--- a/sys/net/if_bridge.c
+++ b/sys/net/if_bridge.c
@@ -2857,11 +2857,8 @@ bridge_input(struct ifnet *ifp, struct mbuf *m)
 	/* We need the Ethernet header later, so make sure we have it now. */
 	if (m->m_len < ETHER_HDR_LEN) {
 		m = m_pullup(m, ETHER_HDR_LEN);
-		if (m == NULL) {
-			if_inc_counter(sc->sc_ifp, IFCOUNTER_IERRORS, 1);
-			m_freem(m);
+		if (m == NULL)
 			return (NULL);
-		}
 	}
 
 	eh = mtod(m, struct ether_header *);