git: e4a457d13576 - main - if_geneve: Fix mbuf leak on ip_ecn_egress

The branch main has been updated by pouria:

URL: https://cgit.FreeBSD.org/src/commit/?id=e4a457d1357621265265089a5ece71c368dd2e99

commit e4a457d1357621265265089a5ece71c368dd2e99
Author:     Pouria Mousavizadeh Tehrani <pouria@FreeBSD.org>
AuthorDate: 2026-07-20 20:33:55 +0000
Commit:     Pouria Mousavizadeh Tehrani <pouria@FreeBSD.org>
CommitDate: 2026-07-20 21:21:54 +0000

    if_geneve: Fix mbuf leak on ip_ecn_egress
    
    Free mbuf and increase IFCOUNTER_IERRORS if ip_ecn_egress() under
    geneve_input_inherit() decides to drop the packet.
    
    Reported by: Chris Jarrett-Davies of the OpenAI Codex Security Team
    Reviewed by: markj
    Differential Revision: https://reviews.freebsd.org/D58361
---
 sys/net/if_geneve.c | 21 +++++----------------
 1 file changed, 5 insertions(+), 16 deletions(-)

diff --git a/sys/net/if_geneve.c b/sys/net/if_geneve.c
index 59822045b77b..04873f0b7964 100644
--- a/sys/net/if_geneve.c
+++ b/sys/net/if_geneve.c
@@ -3125,16 +3125,12 @@ geneve_input_inherit(struct geneve_softc *sc, struct mbuf **m0,
 			return (EINVAL);
 
 		if (m->m_len < offset &&
-		    (m = m_pullup(m, offset)) == NULL) {
-			*m0 = NULL;
+		    (*m0 = m = m_pullup(m, offset)) == NULL)
 			return (ENOBUFS);
-		}
 		iphdr = mtodo(m, offset - sizeof(struct ip));
 
-		if (ip_ecn_egress(ECN_COMPLETE, &info->ecn, &iphdr->ip_tos) == 0) {
-			*m0 = NULL;
+		if (ip_ecn_egress(ECN_COMPLETE, &info->ecn, &iphdr->ip_tos) == 0)
 			return (ENOBUFS);
-		}
 
 		if ((sc->gnv_flags & GENEVE_FLAG_TTL_INHERIT) != 0 && info->ttl > 0)
 			iphdr->ip_ttl = info->ttl;
@@ -3148,17 +3144,13 @@ geneve_input_inherit(struct geneve_softc *sc, struct mbuf **m0,
 			return (EINVAL);
 
 		if (m->m_len < offset &&
-		    (m = m_pullup(m, offset)) == NULL) {
-			*m0 = NULL;
+		    (*m0 = m = m_pullup(m, offset)) == NULL)
 			return (ENOBUFS);
-		}
 		ip6hdr = mtodo(m, offset - sizeof(struct ip6_hdr));
 
 		itos = (ntohl(ip6hdr->ip6_flow) >> IPV6_FLOWLABEL_LEN) & 0xff;
-		if (ip_ecn_egress(ECN_COMPLETE, &info->ecn, &itos) == 0) {
-			*m0 = NULL;
+		if (ip_ecn_egress(ECN_COMPLETE, &info->ecn, &itos) == 0)
 			return (ENOBUFS);
-		}
 		ip6hdr->ip6_flow |= htonl((uint32_t)itos << IPV6_FLOWLABEL_LEN);
 
 		if ((sc->gnv_flags & GENEVE_FLAG_TTL_INHERIT) && (info->ttl > 0))
@@ -3176,10 +3168,8 @@ geneve_input_inherit(struct geneve_softc *sc, struct mbuf **m0,
 			return (EINVAL);
 
 		if (m->m_len < offset &&
-		    (m = m_pullup(m, offset)) == NULL) {
-			*m0 = NULL;
+		    (*m0 = m = m_pullup(m, offset)) == NULL)
 			return (ENOBUFS);
-		}
 		info->isr = NETISR_ARP;
 		break;
 
@@ -3188,7 +3178,6 @@ geneve_input_inherit(struct geneve_softc *sc, struct mbuf **m0,
 		return (EINVAL);
 	}
 
-	*m0 = m;
 	return (0);
 }