From nobody Fri Sep 11 17:16:26 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hhLmp5DQ7z6sfW9 for ; Fri, 11 Sep 2026 17:16:26 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hhLmp4ptlz4npq for ; Fri, 11 Sep 2026 17:16:26 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1789146986; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=iVyDyV2Rsz0wmh8XAlgMEPjgFMctYZkjlEWFhs7pOS4=; b=tb3QbwDbF5d2IVVaVXww75JUUfFiduR30i7j12DtxaCsmIZEyl8pSUj/hIPcMuJILeL09/ k8B4vfPvambCOI6R+feiMlVo3siGXg4rLvwbkVd4TOZuhWvvzR1APny30nArpj2o4sLIlW V72d+8gRTfD7rNNtJRkFXsXcoqdQJmg3OlwXIweAPtNmrG5yrILCqW2WiTxyPXBf2s0MUU WdDlzTtnjjyxs2krv7Q0/AAYtkYBZV9dG8iaW/8rMeNDTmP7BxAmsjnblduFv8gYd6lqr4 1vASk8wOtTSpWxT+d0MXoVZzaiE5wNkwaTfH7n4pIufbCUpGWQnNFcxCaTBqaQ== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1789146986; b=ZJQHukk9QJnmTrCF/Nj9VMAX2hz8LVro4dFQELH4dPTWTb5PdtD6tsAoYBHlsDCJxZbu4P pQYu1qUhu5e6voYkS9YoSdMgY8RlrmJhy9FvjBOoNi6bpLnPtwIhCszyqWcvrfqep/0IpK zFvdW3ISH6KXrRpEebaSn9sYxxRP+0Dg5dykCeW9busC635CKAzUL/BgrawdVKLsizMxEI d3Js40jOEWxM2jYZDMelhSnxlpCwbr/AXTiBbBPZ7UASeEi5mY/pcx1EbAn/OHGJst9RkT PgjRVbG0QJwkdWJmamIMmCNADs87koYLwuhoB9E57S5c2ShT93E6WpTLBqEZAg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1789146986; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=iVyDyV2Rsz0wmh8XAlgMEPjgFMctYZkjlEWFhs7pOS4=; b=dES10jsYGLLW6TQV/K0mxs7fE2YQ+1c0yOF1kbnDD3BtERGPhGRmGEIDvViDxo0+w+HC3N 8Hmn/ClMjGV/lxIgWGsGgH1aufgbvsk2LwKNuWsf7Ni5Hv/D0vB4D0fBHRTT69aw6i7vBX wd9/0MjqnomGHf09DZTWdTu3uXTo1J4Mz84lKrSAEwynhb63Tatuz8cUEab9ZHnmc1lEvp jLZdxfkQ0Expv08yxSNPpuIEOtHJ0ccWSspHHYxpA6bAKeVLkvo/nFeN4AG0Gbwg/oDdVv Ci+PPS6V0GvDdr7jIL1iMe+mTFtE617ePtBrTTqE/+Dr09FJLMY4ZjrD8sAk3A== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hhLmp3VVDzMpp for ; Fri, 11 Sep 2026 17:16:26 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 4209c by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Fri, 11 Sep 2026 17:16:26 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Alexander Leidinger Subject: git: 26248c370fad - main - if_bridge: pull up only the headers bridge_pfil() inspects List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: netchild X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 26248c370fade359e5303094fb57102d7fcc9c78 Auto-Submitted: auto-generated Date: Fri, 11 Sep 2026 17:16:26 +0000 Message-Id: <6aa4376a.4209c.2142830d@gitrepo.freebsd.org> The branch main has been updated by netchild: URL: https://cgit.FreeBSD.org/src/commit/?id=26248c370fade359e5303094fb57102d7fcc9c78 commit 26248c370fade359e5303094fb57102d7fcc9c78 Author: Alexander Leidinger AuthorDate: 2026-09-04 07:35:59 +0000 Commit: Alexander Leidinger CommitDate: 2026-09-11 17:16:09 +0000 if_bridge: pull up only the headers bridge_pfil() inspects bridge_pfil() pulled up min(m_pkthdr.len, max_protohdr) bytes. When the mapped head is shorter than that and followed by an unmapped (M_EXTPG) mbuf -- a sendfile(2) or KTLS segment from a member advertising IFCAP_MEXTPG -- m_pullup() ran into it and dereferenced a NULL mtod(), panicking the kernel. Pull up the Ethernet header first, and the SNAP/LLC header only for an 802.3 frame. This is similar to pf and ip_output(). m_pullup() and m_copyup() asserted only the first mbuf; assert inside both copy loops so the shape trips the check. Fixes: c38abd64dbc1 ("if_epair: support IFCAP_MEXTPG") Suggested by: markj Reviewed by: markj, gallatin Assisted-by: Claude Code (Fable 5, Opus 5) --- sys/kern/uipc_mbuf.c | 4 ++++ sys/net/if_bridge.c | 35 ++++++++++++++++++++++++----------- 2 files changed, 28 insertions(+), 11 deletions(-) diff --git a/sys/kern/uipc_mbuf.c b/sys/kern/uipc_mbuf.c index 3f7841721a86..726d3ccb5536 100644 --- a/sys/kern/uipc_mbuf.c +++ b/sys/kern/uipc_mbuf.c @@ -957,6 +957,8 @@ m_pullup(struct mbuf *n, int len) } space = &m->m_dat[MLEN] - (m->m_data + m->m_len); do { + KASSERT((n->m_flags & M_EXTPG) == 0, + ("%s: unmapped mbuf %p in chain", __func__, n)); count = min(min(max(len, max_protohdr), space), n->m_len); bcopy(mtod(n, caddr_t), mtod(m, caddr_t) + m->m_len, (u_int)count); @@ -1001,6 +1003,8 @@ m_copyup(struct mbuf *n, int len, int dstoff) m->m_data += dstoff; space = &m->m_dat[MLEN] - (m->m_data + m->m_len); do { + KASSERT((n->m_flags & M_EXTPG) == 0, + ("%s: unmapped mbuf %p in chain", __func__, n)); count = min(min(max(len, max_protohdr), space), n->m_len); memcpy(mtod(m, caddr_t) + m->m_len, mtod(n, caddr_t), (unsigned)count); diff --git a/sys/net/if_bridge.c b/sys/net/if_bridge.c index ef7101f13224..f45b0a5822c9 100644 --- a/sys/net/if_bridge.c +++ b/sys/net/if_bridge.c @@ -3956,9 +3956,8 @@ bridge_pfil(struct mbuf **mp, struct ifnet *bifp, struct ifnet *ifp, int dir) if (V_pfil_bridge == 0 && V_pfil_member == 0 && V_pfil_ipfw == 0) return (0); /* filtering is disabled */ - i = min((*mp)->m_pkthdr.len, max_protohdr); - if ((*mp)->m_len < i) { - *mp = m_pullup(*mp, i); + if ((*mp)->m_len < ETHER_HDR_LEN) { + *mp = m_pullup(*mp, ETHER_HDR_LEN); if (*mp == NULL) { printf("%s: m_pullup failed\n", __func__); return (-1); @@ -3972,14 +3971,28 @@ bridge_pfil(struct mbuf **mp, struct ifnet *bifp, struct ifnet *ifp, int dir) * Check for SNAP/LLC. */ if (ether_type < ETHERMTU) { - struct llc *llc2 = (struct llc *)(eh1 + 1); - - if ((*mp)->m_len >= ETHER_HDR_LEN + 8 && - llc2->llc_dsap == LLC_SNAP_LSAP && - llc2->llc_ssap == LLC_SNAP_LSAP && - llc2->llc_control == LLC_UI) { - ether_type = htons(llc2->llc_un.type_snap.ether_type); - snap = 1; + struct llc *llc2; + + i = min((*mp)->m_pkthdr.len, + ETHER_HDR_LEN + sizeof(struct llc)); + if ((*mp)->m_len < i) { + *mp = m_pullup(*mp, i); + if (*mp == NULL) { + printf("%s: m_pullup failed\n", __func__); + return (-1); + } + eh1 = mtod(*mp, struct ether_header *); + } + + if ((*mp)->m_len >= ETHER_HDR_LEN + sizeof(struct llc)) { + llc2 = (struct llc *)(eh1 + 1); + if (llc2->llc_dsap == LLC_SNAP_LSAP && + llc2->llc_ssap == LLC_SNAP_LSAP && + llc2->llc_control == LLC_UI) { + ether_type = + htons(llc2->llc_un.type_snap.ether_type); + snap = 1; + } } }