From nobody Fri Oct 23 18:29:51 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4jBBQ747b4z6xQpv for ; Fri, 23 Oct 2026 18:29:51 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4jBBQ72pCjz4F76 for ; Fri, 23 Oct 2026 18:29:51 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1792780191; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=eAjW+0xyYyUZ/Pp/6VxbgN06vjbjKL+iFBaZlVXxYHo=; b=j2YjPoORlw51HtmcKzUVJYJx2XtbSPUdTsW6r1qRYNLKkCi7s6P5XibHr0xmGYeAIFGV36 92K4w6//iaWCugbErNxW+z36cUwT0t6YebquGu81NdFR0Igf3EGIjz1nYoQvx8DpDzVkrP SU2nkBNpZw4kFOxwbVtSVIn9kU2K9VF0aCShWn8X7vN2943u1onLtgVVf0JPoDt8OkKlH/ H9d2f7dUlPmZOWVMWkzILo6d4fIblauua5drUNtS5y4OyiS0nyvCnUF8Ip9XxvcRogSzvR z8SOX+fZPAKLaq+eLIuwXLwnvcs4grZfPQyx7asizXaf0rkBlBUnVzOPBJJ3wQ== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1792780191; b=VxpfZb1JV9bvtlSNDogNfmvfQ52AqFQpGXjTLDoVcFDUkN1EbCQQu5g+fxw9pztoH+GHsp VImVWOqIqjG/cEusPOKVHKsDytRC9cchSCRfH4vWHYIZOtcP5IH8rYciTHl7hb2Jplva2R XJ3Mu1Tx1Tu/3F5U4jM5qumHsb8z0HG5oChDnRWzvRhEFJoOxK+yZId5Etl1PXa+bvYGOU jCodfBuYr6cH3f6S2NTFlIsdOU4n6jSoN4s2MiZqW+rRCx/5G70q98kJVaaAq19u1ifX8N lxSWetFfZRVgT46IJofJggmDsd3U4q3Lg0WHWYhfV4y/02bYlvQd9HQc0BCnDg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1792780191; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=eAjW+0xyYyUZ/Pp/6VxbgN06vjbjKL+iFBaZlVXxYHo=; b=B2w89K0KbyZtUbmQPvqzenj3YgdxOFXAXrNyhLCeBKKpDr84xBz/nzFZJEJ5lrf4rCSUuW T0/6zL0HLDwQAJe/KzNXD4rOWLyP/88nU62tvGGp6sNr777iVEbqo/T49p97eUBFK8ZlVA GTPMnmUGEtZgoTlVG4C/0K9j3bllh17DNEFFvaFt6YONSZlYPWL0YKVBquFOi5xOVY4CZV KFh9q3n8CSUMxvOrLXMAKI5Mg84hndHAnGVdETcNqnV5q5Zc+ljLDbMkljPoWNtzYkICIV t3p0ZexaKebyNkcm5zKXngo9nEqSLkaloqgZdtIDnpwAbrrQSqCw5qCpThPLoQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4jBBQ72SZVzj0P for ; Fri, 23 Oct 2026 18:29:51 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 1f724 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Fri, 23 Oct 2026 18:29:51 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: R. Christian McDonald Subject: git: f1726686cb31 - main - iflib: Do not pull up trailing IPv4 fragments to the L4 header List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: Commit messages for the main branch of the src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: rcm X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: f1726686cb31ff141e507760124f44442c9f141a Auto-Submitted: auto-generated Date: Fri, 23 Oct 2026 18:29:51 +0000 Message-Id: <6adba79f.1f724.2830060f@gitrepo.freebsd.org> The branch main has been updated by rcm: URL: https://cgit.FreeBSD.org/src/commit/?id=f1726686cb31ff141e507760124f44442c9f141a commit f1726686cb31ff141e507760124f44442c9f141a Author: R. Christian McDonald AuthorDate: 2026-10-23 18:28:29 +0000 Commit: R. Christian McDonald CommitDate: 2026-10-23 18:28:29 +0000 iflib: Do not pull up trailing IPv4 fragments to the L4 header iflib_parse_header() pulls every IPv4 packet up to the end of the TCP or UDP header, including fragments at a non-zero offset, which carry no L4 header at all. A trailing fragment shorter than that header (1-7 bytes of UDP, 1-19 bytes of TCP) makes m_pullup() fail and the frame is freed without a trace in the interface counters. Only parse the L4 header on the first fragment. TSO never produces fragments, so assert that. With a 1500-byte MTU every UDP datagram of 1473-1479 bytes is lost behind a forwarding host whose ingress NIC sets receive checksum flags, or on any VLAN with hardware tagging. SIP over UDP is a common victim. Reported by: Alex Roberts Reviewed by: gallatin Fixes: c224b2ce7de0 ("iflib: don't pullup UDP payloads to the TCP header size") See also: https://redmine.pfsense.org/issues/17196 MFC after: 3 days Sponsored by: Rubicon Communications, LLC ("Netgate") --- sys/net/iflib.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/sys/net/iflib.c b/sys/net/iflib.c index d47c108292ae..6682ccbcfca8 100644 --- a/sys/net/iflib.c +++ b/sys/net/iflib.c @@ -3674,7 +3674,7 @@ iflib_parse_header(iflib_txq_t txq, if_pkt_info_t pi, struct mbuf **mp) case ETHERTYPE_IP: { struct ip *ip; - struct tcphdr *th; + struct tcphdr *th = NULL; uint8_t hlen; hlen = pi->ipi_ehdrlen + sizeof(*ip); @@ -3685,7 +3685,13 @@ iflib_parse_header(iflib_txq_t txq, if_pkt_info_t pi, struct mbuf **mp) } ip = (struct ip *)(m->m_data + pi->ipi_ehdrlen); hlen = pi->ipi_ehdrlen + (ip->ip_hl << 2); - if (ip->ip_p == IPPROTO_TCP) { + if ((ip->ip_off & htons(IP_OFFMASK)) != 0) { + /* + * Only the first fragment carries the TCP/UDP header, + * so do not extend hlen beyond the IP header. + */ + MPASS(!IS_TSO4(pi)); + } else if (ip->ip_p == IPPROTO_TCP) { hlen += sizeof(*th); th = (struct tcphdr *)((char *)ip + (ip->ip_hl << 2)); } else if (ip->ip_p == IPPROTO_UDP) { @@ -3697,7 +3703,8 @@ iflib_parse_header(iflib_txq_t txq, if_pkt_info_t pi, struct mbuf **mp) return (ENOMEM); /* reset pointers after pullup */ ip = (struct ip *)(m->m_data + pi->ipi_ehdrlen); - th = (struct tcphdr *)((char *)ip + (ip->ip_hl << 2)); + if (th != NULL) + th = (struct tcphdr *)((char *)ip + (ip->ip_hl << 2)); } pi->ipi_ip_hlen = ip->ip_hl << 2; pi->ipi_ipproto = ip->ip_p; @@ -3706,7 +3713,7 @@ iflib_parse_header(iflib_txq_t txq, if_pkt_info_t pi, struct mbuf **mp) /* TCP checksum offload may require TCP header length */ if (IS_TX_OFFLOAD4(pi)) { - if (__predict_true(pi->ipi_ipproto == IPPROTO_TCP)) { + if (__predict_true(th != NULL)) { pi->ipi_tcp_hflags = tcp_get_flags(th); pi->ipi_tcp_hlen = th->th_off << 2; pi->ipi_tcp_seq = th->th_seq;