Page MenuHomeFreeBSD
Differential D58361

if_geneve: Fix mbuf leak on ip_ecn_egress
ClosedPublic
Actions

Authored by pouria on Jul 20 2026, 8:46 PM.
Tags
None
Referenced Files
F168985246: D58361.id182306.diff
Mon, Aug 31, 1:36 AM
F168937415: D58361.id182312.diff
Sun, Aug 30, 8:36 PM
F168935791: D58361.id182311.diff
Sun, Aug 30, 8:25 PM
F168931317: D58361.id.diff
Sun, Aug 30, 7:51 PM
F168931024: D58361.diff
Sun, Aug 30, 7:48 PM
F168914488: D58361.id182310.diff
Sun, Aug 30, 5:46 PM
Unknown Object (File)
Sat, Aug 29, 7:10 PM
Unknown Object (File)
Thu, Aug 27, 9:28 AM
View All 56 Files
Subscribers
ae
glebius
imp
melifaro

Details

Reviewers
markj
Group Reviewers
network
Commits
rGe4a457d13576: if_geneve: Fix mbuf leak on ip_ecn_egress
Summary

Free mbuf and increase IFCOUNTER_IERRORS if ip_ecn_egress() under
geneve_input_inherit() decides to drop the packet.

Reported by: Chris Jarrett-Davies of the OpenAI Codex Security Team

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped
Build Status
Buildable 74963
Build 71846: arc lint + arc unit

Event Timeline

pouria created this revision.Jul 20 2026, 8:46 PM
Herald added subscribers: glebius, melifaro, ae, imp. · View Herald TranscriptJul 20 2026, 8:46 PM
pouria requested review of this revision.Jul 20 2026, 8:46 PM
Harbormaster completed remote builds in B74963: Diff 182306.Jul 20 2026, 8:46 PM
pouria edited the summary of this revision. (Show Details)Jul 20 2026, 8:59 PM
markj added inline comments.Jul 20 2026, 9:02 PM
sys/net/if_geneve.c
3134

The m_pullup() call above may free the old mbuf. In that case, since *m0 hasn't been updated, geneve_udp_input() will free the mbuf again in this error path.

IMO it is easiest to just

m_freem(m);
*m0 = NULL;
return (ENOBUFS);
pouria added inline comments.Jul 20 2026, 9:10 PM
sys/net/if_geneve.c
3128–3131

how about this one?

markj added inline comments.Jul 20 2026, 9:14 PM
sys/net/if_geneve.c
3128–3131

That's fine too.

pouria updated this revision to Diff 182310.Jul 20 2026, 9:16 PM

Address @markj comment

Harbormaster completed remote builds in B74965: Diff 182310.Jul 20 2026, 9:16 PM
markj accepted this revision.Jul 20 2026, 9:17 PM
markj added inline comments.
sys/net/if_geneve.c
3187

Now you can remove this assignment.

This revision is now accepted and ready to land.Jul 20 2026, 9:17 PM
pouria updated this revision to Diff 182311.Jul 20 2026, 9:21 PM
pouria marked 3 inline comments as done.

Address @markj comment, remove redundant *m0 = m assignment

This revision now requires review to proceed.Jul 20 2026, 9:21 PM
Harbormaster completed remote builds in B74966: Diff 182311.Jul 20 2026, 9:21 PM
markj accepted this revision.Jul 20 2026, 9:22 PM
This revision is now accepted and ready to land.Jul 20 2026, 9:22 PM
Closed by commit rGe4a457d13576: if_geneve: Fix mbuf leak on ip_ecn_egress (authored by pouria). · Explain WhyJul 20 2026, 9:24 PM
This revision was automatically updated to reflect the committed changes.
pouria added a commit: rGe4a457d13576: if_geneve: Fix mbuf leak on ip_ecn_egress.
markj added inline comments.Jul 20 2026, 9:29 PM
sys/net/if_geneve.c
2844

BTW, there is a leak in this error path too, though I suspect this might not be triggerable in practice.

Revision Contents
Changeset List

PathSize
sys/
net/
8 lines

Diff 182306

View Options

sys/net/if_geneve.c

Loading...