From nobody Mon Oct 05 13:23:23 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hz0Sq4Xjrz6jqrJ for ; Mon, 05 Oct 2026 13:23:23 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hz0Sq2MClz4pV7 for ; Mon, 05 Oct 2026 13:23:23 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791206603; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=HJkUY6p8cKwivDVBOxWePlMRyZVw/eCnnQMEveDWYhg=; b=gpOmQFS5mtlNzscDjh0V7qJ8fhT1jwDDUk478y6g0bSs5dcaBaTbbSD4T3F8kTuO2aQkxb XflCly3ckcqVCtXYbs1Hgn1ZKpmSVYuOTeUUjJSK6tSxUZDBVPwY1tJFTOhYTcw5Ic8HH9 /5WInLXzynGPKbpYOCzl+ixfhS4AkIjv8SW6itLPitqYnyVC639h6nijs0TFd1fVGV4t4U WKytdc7pGQpY+KagQPHNXmhNryWQZcpxyZCGZRSeAgewDs0SrW3NPUEsUARPa985mUD9F2 C6PJCNSdGBo4nbeVuPwW7paM5jXY0Y5o6hTlyJG4r960m3qSFlg6tCUgwDPN6w== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1791206603; b=eUNDaEwq514Hgf8zyG4tSaSG6Wm4X4uaJRDmZUGQh6Ctr9k01OFqNx4KxcHZISA602YYjb Xw+KynD4RwJ7P81RYXF5ApgZv4N6eWbuKhoFfZCxuGHh4hHKBeHo9yXwjG+i1pzaT0upcA XioFoEPROdQ3VO+6n2qxoItc8UB/Oxk9PVJOR0UIIO6Uv+8hdEngYkLdFzS7uWb4i2Lj7y 7IFjRTnawZAHwTa9seLEBAlIYq2ysnI0XkHvIamOx/UUqxZ2NVyEC/2jGg1K+9Ju/9Ncom XLIBnoyw/ODKw62l1KzBvVjTLHM6ug/xBBaua4z0gGOTB+lhxkDwpAIFx0Yjgw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791206603; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=HJkUY6p8cKwivDVBOxWePlMRyZVw/eCnnQMEveDWYhg=; b=E4NOuGS5d5vhj5IAVqOFNF090U+ql2kQIF95fW0gWYimq99SW94/axEx0IvLgglCoQ3Ldd 041FZt11whWiSclme9qbQ0K8oe+vCXvK8rfu+76y42JHqgwHLBFxleiLJwUXJFmjjIufm9 sOMKUr0+9AlxqMUUcHh7egmlJk41M7B9dLf2Q6PL+elTekVXEfsxrF7y9THS9vynH7WdS/ Et4y1UdUjah/X3pb/3zy1YfYkccVokffgwvgTpKo3Y+c40oia62s2gApLaatjcy+WkBSY2 8TXXVDuCRaf0vdjbXayeoeSn/HHkr3qdWdJingz8PrHafgIDKKFOrnLt5JCQKQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hz0Sq0Q7PzL7v for ; Mon, 05 Oct 2026 13:23:23 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 41ff9 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 05 Oct 2026 13:23:23 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Cc: Andrew Griffiths From: Mark Johnston Subject: git: 80af0a32e48b - main - tcp: Preserve borrowed ICMPv6 error mbufs List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 80af0a32e48bff6ad97e768b16d2dbc01ac8d1c3 Auto-Submitted: auto-generated Date: Mon, 05 Oct 2026 13:23:23 +0000 Message-Id: <6ac3a4cb.41ff9.c4256a2@gitrepo.freebsd.org> The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=80af0a32e48bff6ad97e768b16d2dbc01ac8d1c3 commit 80af0a32e48bff6ad97e768b16d2dbc01ac8d1c3 Author: Andrew Griffiths AuthorDate: 2026-10-05 13:14:38 +0000 Commit: Mark Johnston CommitDate: 2026-10-05 13:21:20 +0000 tcp: Preserve borrowed ICMPv6 error mbufs The TCP-over-UDP ICMP callback receives ip6c_m as a borrowed chain owned by icmp6_notify_error. It used m_pulldown() to obtain a contiguous UDP header even though that API frees the complete chain when the requested range is unavailable. The callback could then return without propagating the lost ownership, leaving raw ICMP delivery to read and free a stale head. Validate that the complete UDP header was quoted, copy it through the chain with m_copydata(), and temporarily advance the parser offset instead of consuming bytes from the caller-owned packet. A remote sender can reach the old path when TCP UDP tunneling is enabled by quoting the configured local UDP source port in an ICMPv6 error and including only four through seven UDP-header bytes. Signed-off-by: Andrew Griffiths Reviewed by: pouria, tuexen, markj MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D60143 --- sys/netinet/tcp_subr.c | 22 +++++++++------------- 1 file changed, 9 insertions(+), 13 deletions(-) diff --git a/sys/netinet/tcp_subr.c b/sys/netinet/tcp_subr.c index 1be803ed443f..4650e8035260 100644 --- a/sys/netinet/tcp_subr.c +++ b/sys/netinet/tcp_subr.c @@ -3392,25 +3392,21 @@ static void tcp6_ctlinput_viaudp(udp_tun_icmp_param_t param) { struct ip6ctlparam *ip6cp = param.ip6cp; - struct mbuf *m; - struct udphdr *udp; + struct udphdr udp; uint16_t port; - m = m_pulldown(ip6cp->ip6c_m, ip6cp->ip6c_off, sizeof(struct udphdr), NULL); - if (m == NULL) { + if (ip6cp->ip6c_m->m_pkthdr.len < + ip6cp->ip6c_off + sizeof(struct udphdr)) return; - } - udp = mtod(m, struct udphdr *); - if (ntohs(udp->uh_sport) != V_tcp_udp_tunneling_port) { + m_copydata(ip6cp->ip6c_m, ip6cp->ip6c_off, sizeof(udp), + (caddr_t)&udp); + if (ntohs(udp.uh_sport) != V_tcp_udp_tunneling_port) return; - } - port = udp->uh_dport; - m_adj(m, sizeof(struct udphdr)); - if ((m->m_flags & M_PKTHDR) == 0) { - ip6cp->ip6c_m->m_pkthdr.len -= sizeof(struct udphdr); - } + port = udp.uh_dport; + ip6cp->ip6c_off += sizeof(struct udphdr); /* Now call in to the normal handling code */ tcp6_ctlinput_with_port(ip6cp, port); + ip6cp->ip6c_off -= sizeof(struct udphdr); } #endif /* INET6 */