diff options
| author | Michael Tuexen <tuexen@FreeBSD.org> | 2026-03-25 05:53:56 +0000 |
|---|---|---|
| committer | Gordon Tetlow <gordon@FreeBSD.org> | 2026-03-26 01:28:29 +0000 |
| commit | b45e7530ffb92fbaa24ad25c368479d4eb80dbf4 (patch) | |
| tree | a88f37101bae40342da9d778cdf4f6a0c4a13c99 | |
| parent | 12e1ab887d58d18069554e0b5311d43d4ca50df0 (diff) | |
tcp: plug an mbuf leak
When a challenge ACK should be sent via tcp_send_challenge_ack(),
but the rate limiter suppresses the sending, free the mbuf chain.
The caller of tcp_send_challenge_ack() expects this similar to the
callers of tcp_respond().
Approved by: so
Security: FreeBSD-SA-26:06.tcp
Security: CVE-2026-4247
Reviewed by: lstewart
Tested by: lstewart
Sponsored by: Netflix, Inc.
(cherry picked from commit 6b2d6ccad2552e46a5c9c3ba70b2d0ed27c70ca8)
| -rw-r--r-- | sys/netinet/tcp_subr.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/sys/netinet/tcp_subr.c b/sys/netinet/tcp_subr.c index 81b378f496c9..32c30dc4d067 100644 --- a/sys/netinet/tcp_subr.c +++ b/sys/netinet/tcp_subr.c @@ -2276,6 +2276,8 @@ tcp_send_challenge_ack(struct tcpcb *tp, struct tcphdr *th, struct mbuf *m) tcp_respond(tp, mtod(m, void *), th, m, tp->rcv_nxt, tp->snd_nxt, TH_ACK); tp->last_ack_sent = tp->rcv_nxt; + } else { + m_freem(m); } } |