The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=b9db5a5b16477863654f92ec653e8464528ef981
commit b9db5a5b16477863654f92ec653e8464528ef981 Author: Mark Johnston <[email protected]> AuthorDate: 2026-08-11 16:42:41 +0000 Commit: Mark Johnston <[email protected]> CommitDate: 2026-08-11 17:02:40 +0000 in_mcast: Fix uninitialized variable usage in inm_merge() When the first loop in inm_merge() hits an error, generally because it hit some limit on the number of source filters for a multicast group, inm_merge() tries to atomically roll back changes to the group source filter list. To roll back, it iterates over the global source filter list for the multicast group, starting at the last entry that we updated ("nims"). But, if we have not yet updated any entries, this variable is uninitialized. Initialize it to NULL, so that RB_FOREACH_REVERSE_FROM doesn't visit any source filters in this case. All of the above applies to the v6 case. Reported by: Daniel Birtwhistle MFC after: 1 week Sponsored by: The FreeBSD Foundation --- sys/netinet/in_mcast.c | 1 + sys/netinet6/in6_mcast.c | 1 + 2 files changed, 2 insertions(+) diff --git a/sys/netinet/in_mcast.c b/sys/netinet/in_mcast.c index ad908b72c340..e81096859770 100644 --- a/sys/netinet/in_mcast.c +++ b/sys/netinet/in_mcast.c @@ -1018,6 +1018,7 @@ inm_merge(struct in_multi *inm, /*const*/ struct in_mfilter *imf) * Maintain a count of source filters whose state was * actually modified by this operation. */ + nims = NULL; RB_FOREACH(ims, ip_msource_tree, &imf->imf_sources) { lims = (struct in_msource *)ims; if (lims->imsl_st[0] == imf->imf_st[0]) nsrc0++; diff --git a/sys/netinet6/in6_mcast.c b/sys/netinet6/in6_mcast.c index 036d58e5bd92..49b0537454df 100644 --- a/sys/netinet6/in6_mcast.c +++ b/sys/netinet6/in6_mcast.c @@ -1042,6 +1042,7 @@ in6m_merge(struct in6_multi *inm, /*const*/ struct in6_mfilter *imf) * Maintain a count of source filters whose state was * actually modified by this operation. */ + nims = NULL; RB_FOREACH(ims, ip6_msource_tree, &imf->im6f_sources) { lims = (struct in6_msource *)ims; if (lims->im6sl_st[0] == imf->im6f_st[0]) nsrc0++;
