The branch main has been updated by pouria: URL: https://cgit.FreeBSD.org/src/commit/?id=e4a457d1357621265265089a5ece71c368dd2e99
commit e4a457d1357621265265089a5ece71c368dd2e99 Author: Pouria Mousavizadeh Tehrani <[email protected]> AuthorDate: 2026-07-20 20:33:55 +0000 Commit: Pouria Mousavizadeh Tehrani <[email protected]> CommitDate: 2026-07-20 21:21:54 +0000 if_geneve: Fix mbuf leak on ip_ecn_egress Free mbuf and increase IFCOUNTER_IERRORS if ip_ecn_egress() under geneve_input_inherit() decides to drop the packet. Reported by: Chris Jarrett-Davies of the OpenAI Codex Security Team Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D58361 --- sys/net/if_geneve.c | 21 +++++---------------- 1 file changed, 5 insertions(+), 16 deletions(-) diff --git a/sys/net/if_geneve.c b/sys/net/if_geneve.c index 59822045b77b..04873f0b7964 100644 --- a/sys/net/if_geneve.c +++ b/sys/net/if_geneve.c @@ -3125,16 +3125,12 @@ geneve_input_inherit(struct geneve_softc *sc, struct mbuf **m0, return (EINVAL); if (m->m_len < offset && - (m = m_pullup(m, offset)) == NULL) { - *m0 = NULL; + (*m0 = m = m_pullup(m, offset)) == NULL) return (ENOBUFS); - } iphdr = mtodo(m, offset - sizeof(struct ip)); - if (ip_ecn_egress(ECN_COMPLETE, &info->ecn, &iphdr->ip_tos) == 0) { - *m0 = NULL; + if (ip_ecn_egress(ECN_COMPLETE, &info->ecn, &iphdr->ip_tos) == 0) return (ENOBUFS); - } if ((sc->gnv_flags & GENEVE_FLAG_TTL_INHERIT) != 0 && info->ttl > 0) iphdr->ip_ttl = info->ttl; @@ -3148,17 +3144,13 @@ geneve_input_inherit(struct geneve_softc *sc, struct mbuf **m0, return (EINVAL); if (m->m_len < offset && - (m = m_pullup(m, offset)) == NULL) { - *m0 = NULL; + (*m0 = m = m_pullup(m, offset)) == NULL) return (ENOBUFS); - } ip6hdr = mtodo(m, offset - sizeof(struct ip6_hdr)); itos = (ntohl(ip6hdr->ip6_flow) >> IPV6_FLOWLABEL_LEN) & 0xff; - if (ip_ecn_egress(ECN_COMPLETE, &info->ecn, &itos) == 0) { - *m0 = NULL; + if (ip_ecn_egress(ECN_COMPLETE, &info->ecn, &itos) == 0) return (ENOBUFS); - } ip6hdr->ip6_flow |= htonl((uint32_t)itos << IPV6_FLOWLABEL_LEN); if ((sc->gnv_flags & GENEVE_FLAG_TTL_INHERIT) && (info->ttl > 0)) @@ -3176,10 +3168,8 @@ geneve_input_inherit(struct geneve_softc *sc, struct mbuf **m0, return (EINVAL); if (m->m_len < offset && - (m = m_pullup(m, offset)) == NULL) { - *m0 = NULL; + (*m0 = m = m_pullup(m, offset)) == NULL) return (ENOBUFS); - } info->isr = NETISR_ARP; break; @@ -3188,7 +3178,6 @@ geneve_input_inherit(struct geneve_softc *sc, struct mbuf **m0, return (EINVAL); } - *m0 = m; return (0); }
