NetBSD Problem Report #60721

From www@netbsd.org  Sat Sep 12 09:35:22 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "mail.netbsd.org", Issuer "YR1" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 472F51A923C
	for <gnats-bugs@gnats.NetBSD.org>; Sat, 12 Sep 2026 09:35:22 +0000 (UTC)
Message-Id: <20260912093520.CB4BB1A923E@mollari.NetBSD.org>
Date: Sat, 12 Sep 2026 09:35:20 +0000 (UTC)
From: joe@ns1.eloisystems.com
Reply-To: joe@ns1.eloisystems.com
To: gnats-bugs@NetBSD.org
Subject: Possible double freeing in npf routing
X-Send-Pr-Version: www-1.0
X-From4GNATS: "joe@ns1.eloisystems.com via gnats" <gnats-admin@NetBSD.org>

>Number:         60721
>Category:       kern
>Synopsis:       Possible double freeing in npf routing
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    joe
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Sep 12 09:40:00 +0000 2026
>Last-Modified:  Sun Sep 13 01:20:01 +0000 2026
>Originator:     Emmanuel Nyarko
>Release:        NetBSD current
>Organization:
NetBSD
>Environment:
NetBSD Joe 11.99.8 NetBSD 11.99.8 (GENERIC) #8: Sat Sep 12 08:16:35 UTC 202
>Description:
possible double freeing in npf routing if the IPv4 or IPv6 output path fails.

in both ip_output and ip6_output, the mbuf gets freed either in a success or failure path.

freeing the packet in failure path in npf route could lead to calling free on an mbuf twice.
>How-To-Repeat:
code inspection. Routing via 
>Fix:

if an error occurred on ip_output or ip6_output, 

set the mbuf (already freed) to NULL.

Index: src/sys/net/npf/npf_ext_route.c
===================================================================
RCS file: /cvsroot/src/sys/net/npf/npf_ext_route.c,v
retrieving revision 1.1
diff -u -r1.1 npf_ext_route.c
--- src/sys/net/npf/npf_ext_route.c	8 Apr 2026 00:33:07 -0000	1.1
+++ src/sys/net/npf/npf_ext_route.c	12 Sep 2026 09:30:12 -0000
@@ -364,6 +364,7 @@
 				error = ip6_if_output(ifp, ifp, m0, &dst.v6, NULL);

 			if (error) {
+				m0 = NULL;
 				goto bad;
 			}

@@ -406,6 +407,7 @@
 			error = ip_if_output(ifp, m, sintocsa(&dst.v4), NULL);

 		if (error) {
+			m0 = NULL;
 			goto bad;
 		}
 		goto done;

>Release-Note:

>Audit-Trail:

Responsible-Changed-From-To: kern-bug-people->joe
Responsible-Changed-By: joe@NetBSD.org
Responsible-Changed-When: Sat, 12 Sep 2026 09:47:05 +0000
Responsible-Changed-Why:
submitting fix 


From: "Emmanuel" <joe@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60721 CVS commit: src/sys/net/npf
Date: Sat, 12 Sep 2026 10:02:15 +0000

 Module Name:	src
 Committed By:	joe
 Date:		Sat Sep 12 10:02:15 UTC 2026

 Modified Files:
 	src/sys/net/npf: npf_ext_route.c

 Log Message:
 PR kern/60721

 set mbuf to NULL in error paths of ip_output and ip6_output.

 avoid calling free twice on a non-NULL pointer.


 To generate a diff of this commit:
 cvs rdiff -u -r1.1 -r1.2 src/sys/net/npf/npf_ext_route.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Emmanuel" <joe@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60721 CVS commit: src/sys/net/npf
Date: Sun, 13 Sep 2026 01:11:56 +0000

 Module Name:	src
 Committed By:	joe
 Date:		Sun Sep 13 01:11:56 UTC 2026

 Modified Files:
 	src/sys/net/npf: npf_ext_route.c

 Log Message:
 PR kern/60721

 Avoid double freeing of outgoing packet when routing takes over.
 memset it before ip_output tries to free it again its final path.


 To generate a diff of this commit:
 cvs rdiff -u -r1.3 -r1.4 src/sys/net/npf/npf_ext_route.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Emmanuel" <joe@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60721 CVS commit: src/sys/net/npf
Date: Sun, 13 Sep 2026 01:19:40 +0000

 Module Name:	src
 Committed By:	joe
 Date:		Sun Sep 13 01:19:40 UTC 2026

 Modified Files:
 	src/sys/net/npf: npf_ext_route.c

 Log Message:
 PR kern/60721

 avoid icmp errors in routing path as icmp6_error also frees.

 this avoids double freeing


 To generate a diff of this commit:
 cvs rdiff -u -r1.4 -r1.5 src/sys/net/npf/npf_ext_route.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

>Unformatted:

Home	PR Database Search