git: 9c5f81332bdc - releng/14.5 - in_mcast: Fix uninitialized variable usage in inm_merge()

The branch releng/14.5 has been updated by cperciva:

URL: https://cgit.FreeBSD.org/src/commit/?id=9c5f81332bdc4e4a55ee54bd39e4d4d505097411

commit 9c5f81332bdc4e4a55ee54bd39e4d4d505097411
Author:     Mark Johnston <[email protected]>
AuthorDate: 2026-08-11 16:42:41 +0000
Commit:     Colin Percival <[email protected]>
CommitDate: 2026-08-20 17:52:45 +0000

    in_mcast: Fix uninitialized variable usage in inm_merge()
    
    When the first loop in inm_merge() hits an error, generally because it
    hit some limit on the number of source filters for a multicast group,
    inm_merge() tries to atomically roll back changes to the group source
    filter list.
    
    To roll back, it iterates over the global source filter list for the
    multicast group, starting at the last entry that we updated ("nims").
    But, if we have not yet updated any entries, this variable is
    uninitialized.  Initialize it to NULL, so that RB_FOREACH_REVERSE_FROM
    doesn't visit any source filters in this case.
    
    All of the above applies to the v6 case.
    
    Approved by:    re (cperciva)
    Reported by:    Daniel Birtwhistle
    MFC after:      1 week
    Sponsored by:   The FreeBSD Foundation
    
    (cherry picked from commit b9db5a5b16477863654f92ec653e8464528ef981)
    (cherry picked from commit 843ef8961512682f152266a6cec85de47c7b9396)
---
 sys/netinet/in_mcast.c   | 1 +
 sys/netinet6/in6_mcast.c | 1 +
 2 files changed, 2 insertions(+)

diff --git a/sys/netinet/in_mcast.c b/sys/netinet/in_mcast.c
index 4fd00bac3ae4..b379053706cb 100644
--- a/sys/netinet/in_mcast.c
+++ b/sys/netinet/in_mcast.c
@@ -1023,6 +1023,7 @@ inm_merge(struct in_multi *inm, /*const*/ struct in_mfilter *imf)
 	 * Maintain a count of source filters whose state was
 	 * actually modified by this operation.
 	 */
+	nims = NULL;
 	RB_FOREACH(ims, ip_msource_tree, &imf->imf_sources) {
 		lims = (struct in_msource *)ims;
 		if (lims->imsl_st[0] == imf->imf_st[0]) nsrc0++;
diff --git a/sys/netinet6/in6_mcast.c b/sys/netinet6/in6_mcast.c
index 4ec9f36cd9ac..0489e656555a 100644
--- a/sys/netinet6/in6_mcast.c
+++ b/sys/netinet6/in6_mcast.c
@@ -1039,6 +1039,7 @@ in6m_merge(struct in6_multi *inm, /*const*/ struct in6_mfilter *imf)
 	 * Maintain a count of source filters whose state was
 	 * actually modified by this operation.
 	 */
+	nims = NULL;
 	RB_FOREACH(ims, ip6_msource_tree, &imf->im6f_sources) {
 		lims = (struct in6_msource *)ims;
 		if (lims->im6sl_st[0] == imf->im6f_st[0]) nsrc0++;