The branch main has been updated by pouria: URL: https://cgit.FreeBSD.org/src/commit/?id=c006c8dac0e5de354c48e3b5fc2bce4e0e6f5152
commit c006c8dac0e5de354c48e3b5fc2bce4e0e6f5152 Author: Aaron Espinoza <[email protected]> AuthorDate: 2026-08-29 03:16:35 +0000 Commit: Pouria Mousavizadeh Tehrani <[email protected]> CommitDate: 2026-08-30 18:04:18 +0000 if_bridge: Fix NULL softc dereference in bridge_input() In bridge_input, sc is initialized to NULL and doesn't get resolved until after the Ethernet header pullup. So the pullup's failure path ends up dereferencing the NULL sc when bumping up IFCOUNTER_IERRORS. The m_freem call right under it is redundant as the failure path in m_pullup already freed the chain. Drop both lines, matching what we have in bridge_output. ether_input_internal() discards frames shorter than ETHER_HDR_LEN before the bridge hook, so it is unlikely that it will fire. We still keep the guard as lagg(4) and ng_ether(4) may replace the mbuf before the bridge hook. Signed-off-by: Aaron Espinoza <[email protected]> Reviewed by: pouria Pull Request: https://github.com/freebsd/freebsd-src/pull/2393 --- sys/net/if_bridge.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/sys/net/if_bridge.c b/sys/net/if_bridge.c index 792b2c952e7a..ef7101f13224 100644 --- a/sys/net/if_bridge.c +++ b/sys/net/if_bridge.c @@ -2857,11 +2857,8 @@ bridge_input(struct ifnet *ifp, struct mbuf *m) /* We need the Ethernet header later, so make sure we have it now. */ if (m->m_len < ETHER_HDR_LEN) { m = m_pullup(m, ETHER_HDR_LEN); - if (m == NULL) { - if_inc_counter(sc->sc_ifp, IFCOUNTER_IERRORS, 1); - m_freem(m); + if (m == NULL) return (NULL); - } } eh = mtod(m, struct ether_header *);
