diff options
| author | Pouria Mousavizadeh Tehrani <pouria@FreeBSD.org> | 2026-07-20 20:33:55 +0000 |
|---|---|---|
| committer | Pouria Mousavizadeh Tehrani <pouria@FreeBSD.org> | 2026-07-20 21:21:54 +0000 |
| commit | e4a457d1357621265265089a5ece71c368dd2e99 (patch) | |
| tree | 4f7a4d31cd7cb39b559b2ca8980d72dd044684d2 | |
| parent | b273481f2a840a05e4039655be99528e1fa9388c (diff) | |
if_geneve: Fix mbuf leak on ip_ecn_egress
Free mbuf and increase IFCOUNTER_IERRORS if ip_ecn_egress() under
geneve_input_inherit() decides to drop the packet.
Reported by: Chris Jarrett-Davies of the OpenAI Codex Security Team
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D58361
| -rw-r--r-- | sys/net/if_geneve.c | 21 |
1 files changed, 5 insertions, 16 deletions
diff --git a/sys/net/if_geneve.c b/sys/net/if_geneve.c index 59822045b77b..04873f0b7964 100644 --- a/sys/net/if_geneve.c +++ b/sys/net/if_geneve.c @@ -3125,16 +3125,12 @@ geneve_input_inherit(struct geneve_softc *sc, struct mbuf **m0, return (EINVAL); if (m->m_len < offset && - (m = m_pullup(m, offset)) == NULL) { - *m0 = NULL; + (*m0 = m = m_pullup(m, offset)) == NULL) return (ENOBUFS); - } iphdr = mtodo(m, offset - sizeof(struct ip)); - if (ip_ecn_egress(ECN_COMPLETE, &info->ecn, &iphdr->ip_tos) == 0) { - *m0 = NULL; + if (ip_ecn_egress(ECN_COMPLETE, &info->ecn, &iphdr->ip_tos) == 0) return (ENOBUFS); - } if ((sc->gnv_flags & GENEVE_FLAG_TTL_INHERIT) != 0 && info->ttl > 0) iphdr->ip_ttl = info->ttl; @@ -3148,17 +3144,13 @@ geneve_input_inherit(struct geneve_softc *sc, struct mbuf **m0, return (EINVAL); if (m->m_len < offset && - (m = m_pullup(m, offset)) == NULL) { - *m0 = NULL; + (*m0 = m = m_pullup(m, offset)) == NULL) return (ENOBUFS); - } ip6hdr = mtodo(m, offset - sizeof(struct ip6_hdr)); itos = (ntohl(ip6hdr->ip6_flow) >> IPV6_FLOWLABEL_LEN) & 0xff; - if (ip_ecn_egress(ECN_COMPLETE, &info->ecn, &itos) == 0) { - *m0 = NULL; + if (ip_ecn_egress(ECN_COMPLETE, &info->ecn, &itos) == 0) return (ENOBUFS); - } ip6hdr->ip6_flow |= htonl((uint32_t)itos << IPV6_FLOWLABEL_LEN); if ((sc->gnv_flags & GENEVE_FLAG_TTL_INHERIT) && (info->ttl > 0)) @@ -3176,10 +3168,8 @@ geneve_input_inherit(struct geneve_softc *sc, struct mbuf **m0, return (EINVAL); if (m->m_len < offset && - (m = m_pullup(m, offset)) == NULL) { - *m0 = NULL; + (*m0 = m = m_pullup(m, offset)) == NULL) return (ENOBUFS); - } info->isr = NETISR_ARP; break; @@ -3188,7 +3178,6 @@ geneve_input_inherit(struct geneve_softc *sc, struct mbuf **m0, return (EINVAL); } - *m0 = m; return (0); } |