if_geneve: Fix mbuf leak on ip_ecn_egress

[pouria]

Summary

Free mbuf and increase IFCOUNTER_IERRORS if ip_ecn_egress() under
geneve_input_inherit() decides to drop the packet.

Reported by: Chris Jarrett-Davies of the OpenAI Codex Security Team

[markj]

sys/net/if_geneve.c

3132

The m_pullup() call above may free the old mbuf. In that case, since *m0 hasn't been updated, geneve_udp_input() will free the mbuf again in this error path.

IMO it is easiest to just

m_freem(m);
*m0 = NULL;
return (ENOBUFS);

[pouria]

sys/net/if_geneve.c

3127–3130

how about this one?

[markj]

sys/net/if_geneve.c

3127–3130

That's fine too.

[pouria]

Address @markj comment

[markj]

sys/net/if_geneve.c

3180–3181

Now you can remove this assignment.

[pouria]

Address @markj comment, remove redundant *m0 = m assignment

[markj]

sys/net/if_geneve.c

2844

BTW, there is a leak in this error path too, though I suspect this might not be triggerable in practice.