The branch main has been updated by glebius: URL: https://cgit.FreeBSD.org/src/commit/?id=c8a5df48de6f2c5fada622af043f3c3fca88fca1
commit c8a5df48de6f2c5fada622af043f3c3fca88fca1 Author: Gleb Smirnoff <[email protected]> AuthorDate: 2025-09-01 16:33:24 +0000 Commit: Gleb Smirnoff <[email protected]> CommitDate: 2025-09-01 16:33:24 +0000 udp: don't leak mbuf if tunnel didn't consume and inpcb is gone Fixes: e1751ef896119d7372035b1b60f18a6342bd0e3b Reviewed by: tuexen, kp, markj Differential Revision: https://reviews.freebsd.org/D52170 --- sys/netinet/udp_usrreq.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sys/netinet/udp_usrreq.c b/sys/netinet/udp_usrreq.c index 3e6519118a40..4547699b6df5 100644 --- a/sys/netinet/udp_usrreq.c +++ b/sys/netinet/udp_usrreq.c @@ -258,8 +258,11 @@ udp_append(struct inpcb *inp, struct ip *ip, struct mbuf *n, int off, filtered = (*up->u_tun_func)(n, off, inp, (struct sockaddr *)&udp_in[0], up->u_tun_ctx); INP_RLOCK(inp); - if (in_pcbrele_rlocked(inp)) + if (in_pcbrele_rlocked(inp)) { + if (!filtered) + m_freem(n); return (1); + } if (filtered) { INP_RUNLOCK(inp); return (1);
