From nobody Mon Oct 12 16:05:59 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4j3MlC6VbNz6w2Wj for ; Mon, 12 Oct 2026 16:05:59 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4j3MlC50yxz4HBV for ; Mon, 12 Oct 2026 16:05:59 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791821159; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=AceGzTetH++aLXYWY/K7aB/q9Rb50Z6uhIlkpnh+a0c=; b=SscPjaHJ3s57CS5Ti+vaYFX9ndvAPCwo6NiU6t5rswkK4DGDJGvCuN28+BWJarGxgVt8Nt ie2Tj52q9nEJbnYvmR80GZWqzOPXkbscLrJSY++p12V4ULVEx+aLcY61khiz4ctLbUDmmD ekZD8EUALzP4h+RpbqqwrnMYJrKNjEehco3pPY9O+jsaG/1GPQnZB3KDAlNx/5e2CEV89h TI/KSwZO5PMmKPlnThTacZkeS/2T82Z8ep0ZXXE/T7WCcrAtVuxq5IwK2YLBlU2jN5EUBU iRfvm7JGToU9zDJFyB49Uj4JHdm0/ktZ8I0DuCNWopmCItLeoL3R5dOGnCQAnQ== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1791821159; b=Ct3pE96K4qUXsAm8eE6l5AXEjGBAIxrwxtwpe+9JlnbHJTcTB3VMXV54j/0Rk46slH1RGa ydWO+M7eXClddzVpHHhfUENN/nV8x7liMekvcpmmE8nXxJvA8ZsAjxDo886rdNSLKgJjTy OI1pkf+9hkB2EYulyj0jHtu3LPhs2ruBxrkxDJkxBHt5fcrI9kyO4kbzYob6ErNz+vaLZ7 tr3rI+/8LQYma8qIH0RYrc62H5PqTV86Qdrn9NcVOwaWS8mLsrPDQxZS7wkSKc0Jf+Z3mj ku/lXDnOP9CzVg0fGR2fJWtiIzW6pfmyRvW/nlvTRr/E4nD7jBa5ZUFAlRUjgQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791821159; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=AceGzTetH++aLXYWY/K7aB/q9Rb50Z6uhIlkpnh+a0c=; b=x+VMdwny4NlrP0DNNeVV3wDyfHDQchtIiXxN9ETABOkGSLa/IycmxXgkHBG58ZLT2wts9h hiHl/bpVXRJtJouNHK5ULeYNu5L7dkuN061IG9kDDgge2kmC5kbxelRmqEBey27IV/Koq8 GVBN9EI5+mmFin4mXk3BgmoHnfJ/nySldovPhkkpv/EB/RzPQf0qtts7C2HWTpgNFWfwhJ qxV0HdyXOUGwqytQSNBVitMPEKmzQds6qHoYErADbkovkrCmsTIuxJ5WOCbNXMh1dlMhAD /75eWMb6vO1VVWDzFsXMtcJSlmuhQuHCnn+Bz2rxApypolXzlGGMoup5wJxXlA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4j3MlC4186zbwy for ; Mon, 12 Oct 2026 16:05:59 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 1e06f by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 12 Oct 2026 16:05:59 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Kristof Provost Subject: git: ccb19b359aae - main - pf: check extension header length. List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: Commit messages for the main branch of the src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: ccb19b359aae4b7e7315ad61d33d9a35d85849d1 Auto-Submitted: auto-generated Date: Mon, 12 Oct 2026 16:05:59 +0000 Message-Id: <6acd0567.1e06f.50e345e7@gitrepo.freebsd.org> The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=ccb19b359aae4b7e7315ad61d33d9a35d85849d1 commit ccb19b359aae4b7e7315ad61d33d9a35d85849d1 Author: Kristof Provost AuthorDate: 2026-10-12 12:25:07 +0000 Commit: Kristof Provost CommitDate: 2026-10-12 13:08:59 +0000 pf: check extension header length. pf_walk_header6() advances the packet offset for each IPv6 extension header. It was not checked that this does not exceed the packet length if no next header was processed. When used with af-to rules, this could trigger a panic: m_copydata: null mbuf. from Acts1631; OK henning@ sashan@ MFC after: 1 week Obtained from: OpenBSD, bluhm , 6d56112588 Sponsored by: Rubicon Communications, LLC ("Netgate") --- sys/netpfil/pf/pf.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index 3dcb0c29e62a..46f9f044accb 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -10962,7 +10962,7 @@ pf_walk_header6(struct pf_pdesc *pd, struct ip6_hdr *h, u_short *reason) struct ip6_ext ext; struct icmp6_hdr icmp6; struct ip6_rthdr rthdr; - uint32_t end; + uint32_t end, extlen; int hdr_cnt, fraghdr_cnt = 0, rthdr_cnt = 0; pd->off += sizeof(struct ip6_hdr); @@ -11073,9 +11073,20 @@ pf_walk_header6(struct pf_pdesc *pd, struct ip6_hdr *h, u_short *reason) return (PF_DROP); } if (pd->proto == IPPROTO_AH) - pd->off += (ext.ip6e_len + 2) * 4; + extlen = (ext.ip6e_len + 2) * 4; else - pd->off += (ext.ip6e_len + 1) * 8; + extlen = (ext.ip6e_len + 1) * 8; + if (end < pd->off + extlen) { + if (pd->fragoff != 0) { + pd->off = pd->fragoff; + pd->proto = IPPROTO_FRAGMENT; + return (PF_PASS); + } + DPFPRINTF(PF_DEBUG_MISC, "IPv6 long exthdr"); + REASON_SET(reason, PFRES_SHORT); + return (PF_DROP); + } + pd->off += extlen; pd->proto = ext.ip6e_nxt; break; case IPPROTO_ICMPV6: