From nobody Wed Oct 14 16:02:16 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4j4bZ10thSz6vmHQ for ; Wed, 14 Oct 2026 16:02:17 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4j4bZ06KNpz4Wgs for ; Wed, 14 Oct 2026 16:02:16 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791993736; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=rfqfNg6XKwfczhtGeQFkHM3PV2INDxdyfB99RHeXHR8=; b=H7Q9peXankTd6iL8Nlz5ZMhY6RNcDng6HZIRp4pkDWxGoxQLTHLJ4PNn1uis8j5nnTMTQ2 LW2IZFybTbPA4+7qIOlC4ZDY9rsyQwXtrfZJSwgzr11LlMfX2YwUNF+9+p1Fd+W/tXwRWR lyo5lQzHuoMTNGt+0fHN+odAhxqpn9cVkO6E61Wqykl/I+zkvowG6fr9BF+V1YpjfPsl9T nBP2Bpff+Y6FUZv595rDd2Ozt6HAdWP7cURxaYa8xjyOrC3vM1HusJ3oBSGbWJUKAjj8KH U7CXTnBtn/MrRN2LinjnzQPkVbvleN45cUV90HxfHntgOw6M0GGA52o5Vszwdg== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1791993736; b=x7JK/2C7lOZCjOoLSmtnvDAMgHzOpYyvBouW9DeohwbfBhk0EhnS1ROXMGO9vZFGdOOFMQ pxs3vLc8Efc7LKjsJW+H1BU7PhOT0ZKEJk4B5yc0xLcbLhhreN7a9uCGEt2rgFTElT3PZc 4at4aRuhzTU1cFdUDIvYa82CAzuo8sdHt5/7idGoTRGjzUn5lHg2LIpY/6X2Uw9xh7lLOb 473Jk67uHrVYD1YgZJ6s2VsWDWv8G6UGj3KpRi5Uy8UJ/nVtI07zIG+XrXK9KSE3zKicVh XFskR8AmaiXb7X2InQGMVyjaPTlYf59AHs/OI6v8Ywdw75bT9A814eN4BFhP7w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791993736; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=rfqfNg6XKwfczhtGeQFkHM3PV2INDxdyfB99RHeXHR8=; b=gNnqvhzr8K/2cB+rJDd7nhRDmLgHD8CbB718x6aYtNtHjQJz30UAesB3HBx5ue9HTEUyLw 9sDboZm6uyGC/2g2d5i60eOQxt72HIf3fOZwNMlu7cBYetHCQWTPLYtbG5QZCuoGJLeZOm AkgEsUtnDs9+kgnhqWKjV+yjSQ1chsfLrpvxqbqaZNtUB7/7g8clGWeROc8x996RUUkfUB NjbtXQErTfFYcN08u3hWuLWtC4b0IQBOi1rsiuPpyn8yTzrMVg2NbW53KNE2zcxnLohTnS FbPREqHCWpIp0K2+Vu5XD/ZreuQCWkx9RRReC0aFspDHKR3xx7LciMlgtzilqQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4j4bZ05P1vz17RW for ; Wed, 14 Oct 2026 16:02:16 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 261ea by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Wed, 14 Oct 2026 16:02:16 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Cc: Michael Tuexen From: Mark Johnston Subject: git: 9a406a9ec399 - main - tcp/rack: Fix a potential overflow in rack_update_pcm_ack() List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: Commit messages for the main branch of the src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 9a406a9ec399cced14ce5d204ba3fd383544b47f Auto-Submitted: auto-generated Date: Wed, 14 Oct 2026 16:02:16 +0000 Message-Id: <6acfa788.261ea.4f6db5c9@gitrepo.freebsd.org> The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=9a406a9ec399cced14ce5d204ba3fd383544b47f commit 9a406a9ec399cced14ce5d204ba3fd383544b47f Author: Michael Tuexen AuthorDate: 2026-10-12 18:55:21 +0000 Commit: Mark Johnston CommitDate: 2026-10-14 16:00:47 +0000 tcp/rack: Fix a potential overflow in rack_update_pcm_ack() The RACK stack's path capacity measurement module maintains an array of samples, updated when the stack receives an ACK. The array grows as needed, but code which handles the expansion is susceptible to remotely triggerable overflow. This could lead to underallocation and a ~512KB out-of-bounds write. Fix this by bounding the sample array size. Approved by: so Security: FreeBSD-SA-26:70.tcp Security: CVE-2026-101307 Reviewed by: glebius, markj Reported by: Nozomi Networks Security Research --- sys/netinet/tcp_stacks/rack_pcm.c | 17 +++++++++++------ sys/netinet/tcp_stacks/tcp_rack.h | 6 ++++-- 2 files changed, 15 insertions(+), 8 deletions(-) diff --git a/sys/netinet/tcp_stacks/rack_pcm.c b/sys/netinet/tcp_stacks/rack_pcm.c index 1a51097f627c..66297006000e 100644 --- a/sys/netinet/tcp_stacks/rack_pcm.c +++ b/sys/netinet/tcp_stacks/rack_pcm.c @@ -196,17 +196,22 @@ rack_update_pcm_ack(struct tcp_rack *rack, int was_cumack, uint32_t start, uint3 } else { /* Need to expand the array */ struct rack_pcm_stats *n; - uint16_t new_cnt; + size_t new_cnt; - new_cnt = rack->r_ctl.pcm_i.cnt_alloc * 2; - sz = (sizeof(struct rack_pcm_stats) * new_cnt); - n = malloc(sz,M_TCPPCM, M_NOWAIT); - if (n == NULL) { - /* We are dead, no memory */ + new_cnt = (size_t)rack->r_ctl.pcm_i.cnt_alloc * 2; + if (new_cnt > RACK_MAX_PCM_ARRAY) { + /* Too many entries required. */ +stop_measurement: rack->pcm_in_progress = 0; rack->r_ctl.pcm_i.cnt = 0; return; } + sz = (sizeof(struct rack_pcm_stats) * new_cnt); + n = malloc(sz, M_TCPPCM, M_NOWAIT); + if (n == NULL) { + /* We are dead, no memory. */ + goto stop_measurement; + } sz = (sizeof(struct rack_pcm_stats) * rack->r_ctl.pcm_i.cnt_alloc); memcpy(n, rack->r_ctl.pcm_s, sz); free(rack->r_ctl.pcm_s, M_TCPPCM); diff --git a/sys/netinet/tcp_stacks/tcp_rack.h b/sys/netinet/tcp_stacks/tcp_rack.h index 2e2ced089f67..f81d0a4b43fd 100644 --- a/sys/netinet/tcp_stacks/tcp_rack.h +++ b/sys/netinet/tcp_stacks/tcp_rack.h @@ -362,9 +362,11 @@ struct rack_pcm_info { uint16_t cnt; /* Maximum acks present */ uint16_t cnt_alloc; +#define RACK_DEFAULT_PCM_ARRAY 16 +#define RACK_MAX_PCM_ARRAY 1024 }; - -#define RACK_DEFAULT_PCM_ARRAY 16 +_Static_assert(RACK_MAX_PCM_ARRAY <= UINT16_MAX, + "RACK_MAX_PCM_ARRAY must fit in 16 bits"); struct rack_pcm_stats { uint32_t sseq;