Page MenuHomeFreeBSD
Differential D51505

udp: Fix a refcount leak in the tunnel receive path
ClosedPublic
Actions

Authored by markj on Jul 25 2025, 2:27 AM.
Tags
None
Referenced Files
Unknown Object (File)
Thu, Apr 23, 12:23 PM
Unknown Object (File)
Thu, Apr 23, 8:13 AM
Unknown Object (File)
Tue, Apr 21, 1:51 AM
Unknown Object (File)
Mon, Apr 20, 4:14 AM
Unknown Object (File)
Mon, Apr 20, 4:14 AM
Unknown Object (File)
Mon, Apr 20, 4:13 AM
Unknown Object (File)
Sat, Apr 18, 6:18 PM
Unknown Object (File)
Sat, Apr 18, 6:48 AM
View All 74 Files
Subscribers
ae
glebius
imp
melifaro

Details

Reviewers
kp
Group Reviewers
network
transport
Commits
rG4d84cefbba2c: udp: Fix a inpcb refcount leak in the tunnel receive path
rGe1751ef89611: udp: Fix a inpcb refcount leak in the tunnel receive path
Summary

When the socket has a tunneling function attached, udp_append() drops
the inpcb lock before calling it. To keep the inpcb live, we take a
reference. After commit 742e7210d00b we only dropped the reference if
the tunnel consumed the packet, but we need to drop it in either case.

Fixes: 742e7210d00b ("udp: allow udp_tun_func_t() to indicate it did not eat the packet")

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Revision Contents
Changeset List

PathSize
sys/
netinet/
11 lines
netinet6/
11 lines

Diff 159117

View Options

sys/netinet/udp_usrreq.c

Loading...
View Options

sys/netinet6/udp6_usrreq.c

Loading...