Page MenuHomeFreeBSD
Differential D51505

udp: Fix a refcount leak in the tunnel receive path
ClosedPublic
Actions

Authored by markj on Jul 25 2025, 2:27 AM.
Tags
None
Referenced Files
Unknown Object (File)
Thu, Sep 17, 8:42 AM
Unknown Object (File)
Fri, Sep 11, 5:39 AM
Unknown Object (File)
Fri, Sep 11, 5:19 AM
Unknown Object (File)
Sun, Sep 6, 1:57 PM
Unknown Object (File)
Fri, Sep 4, 9:40 PM
Unknown Object (File)
Fri, Sep 4, 4:50 PM
Unknown Object (File)
Fri, Sep 4, 3:14 PM
Unknown Object (File)
Fri, Sep 4, 2:58 PM
View All Files
Subscribers
ae
glebius
imp
melifaro

Details

Reviewers
kp
Group Reviewers
network
transport
Commits
rG4d84cefbba2c: udp: Fix a inpcb refcount leak in the tunnel receive path
rGe1751ef89611: udp: Fix a inpcb refcount leak in the tunnel receive path
Summary

When the socket has a tunneling function attached, udp_append() drops
the inpcb lock before calling it. To keep the inpcb live, we take a
reference. After commit 742e7210d00b we only dropped the reference if
the tunnel consumed the packet, but we need to drop it in either case.

Fixes: 742e7210d00b ("udp: allow udp_tun_func_t() to indicate it did not eat the packet")

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped
Build Status
Buildable 65678
Build 62561: arc lint + arc unit

Revision Contents
Changeset List

PathSize
sys/
netinet/
11 lines
netinet6/
11 lines

Diff 159043

View Options

sys/netinet/udp_usrreq.c

Loading...
View Options

sys/netinet6/udp6_usrreq.c

Loading...