[Bug 284606] Kernel Panic with ipfw

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=284606

--- Comment #39 from commit-hook@FreeBSD.org ---
A commit in branch releng/14.3 references this bug:

URL:
https://cgit.FreeBSD.org/src/commit/?id=c0cb68169bebc4210f9eccf643aeb73bf6d34654

commit c0cb68169bebc4210f9eccf643aeb73bf6d34654
Author:     Kyle Evans <kevans@FreeBSD.org>
AuthorDate: 2025-11-01 17:34:11 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2025-12-16 13:57:34 +0000

    ipfw: pmod: avoid further rule processing after tcp-mod failures

    m_pullup() here will have freed the mbuf chain, but we pass back an
    IP_FW_DENY without any signal that the outer loop should finish.  Thus,
    rule processing continues without an mbuf and there's a chance that we
    conclude that the packet may pass (but there's no mbuf remaining)
    depending on the rules that follow it.

    PR:             284606
    Reviewed by:    ae
    Approved by:    so
    Security:       FreeBSD-SA-25:11.ipfw
    Security:       CVE-2025-14769

    (cherry picked from commit c0382512bfce872102d213b9bc2550de0bc30b67)
    (cherry picked from commit deb684f9d1d6a3681e451d3af31f768c567f7dbe)

 sys/netpfil/ipfw/pmod/tcpmod.c | 25 ++++++++++++++++---------
 1 file changed, 16 insertions(+), 9 deletions(-)

-- 
You are receiving this mail because:
You are on the CC list for the bug.