Differential D51505

udp: Fix a refcount leak in the tunnel receive path
ClosedPublic
Actions

Authored by markj on Jul 25 2025, 2:27 AM.

Tags

None

Referenced Files

	Unknown Object (File)
	Wed, Mar 4, 4:53 PM

	Unknown Object (File)
	Tue, Feb 24, 6:55 PM

	Unknown Object (File)
	Tue, Feb 24, 6:50 PM

	Unknown Object (File)
	Tue, Feb 24, 8:20 AM

	Unknown Object (File)
	Mon, Feb 23, 1:57 PM

	Unknown Object (File)
	Feb 8 2026, 6:16 AM

	Unknown Object (File)
	Feb 8 2026, 4:47 AM

	Unknown Object (File)
	Feb 5 2026, 9:23 AM

View All 54 Files

Subscribers

Details

Reviewers

Group Reviewers

network
transport

Commits

rG4d84cefbba2c: udp: Fix a inpcb refcount leak in the tunnel receive path
rGe1751ef89611: udp: Fix a inpcb refcount leak in the tunnel receive path

Summary

When the socket has a tunneling function attached, udp_append() drops
the inpcb lock before calling it. To keep the inpcb live, we take a
reference. After commit 742e7210d00b we only dropped the reference if
the tunnel consumed the packet, but we need to drop it in either case.

Fixes: 742e7210d00b ("udp: allow udp_tun_func_t() to indicate it did not eat the packet")

Diff Detail

Repository

rG FreeBSD src repository

Lint

Lint Skipped

Unit

Tests Skipped

Build Status

Buildable 65678
Build 62561: arc lint + arc unit

Event Timeline

markj created this revision.Jul 25 2025, 2:27 AM

Herald added a reviewer: transport. · View Herald TranscriptJul 25 2025, 2:27 AM

Herald added subscribers: glebius, melifaro, ae, imp. · View Herald Transcript

markj requested review of this revision.Jul 25 2025, 2:27 AM

Harbormaster completed remote builds in B65678: Diff 159043.Jul 25 2025, 2:27 AM

kp accepted this revision as: kp.Jul 25 2025, 7:49 AM

This revision was not accepted when it landed; it landed in state Needs Review.Jul 25 2025, 5:39 PM

Closed by commit rGe1751ef89611: udp: Fix a inpcb refcount leak in the tunnel receive path (authored by markj). · Explain Why

This revision was automatically updated to reflect the committed changes.

markj added a commit: rGe1751ef89611: udp: Fix a inpcb refcount leak in the tunnel receive path.

markj added a commit: rG4d84cefbba2c: udp: Fix a inpcb refcount leak in the tunnel receive path.Aug 12 2025, 12:56 PM

Revision Contents
Changeset List

Path

Size

sys/

netinet/

11 lines

netinet6/

11 lines

Diff 159043

sys/netinet/udp_usrreq.c

Loading...

sys/netinet6/udp6_usrreq.c

Loading...