From nobody Mon Aug 24 18:49:03 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hTKh01Pg0z6plSq for ; Mon, 24 Aug 2026 18:49:04 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hTKh00R9fz3Ws0 for ; Mon, 24 Aug 2026 18:49:04 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787597344; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=f6clmqJ8tFMoE1TpGc3m8FemNT9vAf/1Ssx2pgTZXv4=; b=tQ693aPTY6zRBgKI+SHdG4ue8yZ3aCOZeIUfI35ITFVRKjfGMRzFT6+5mBX60+zvpkzq8B 1CxFz3MadXfghjSqrExWVwwoob6p8EsXAekxE3OxWfz0RbjcCXmLDPu04H1liGJZ9smapU RNzkmH8vPScf9V7JGC+b2eBxdp8At29ioKI4mz+uluXMpxxT8KPDt0RywugronAZBkkm5Q McCYcdoNWJM24RcFk4brlfc9INspoqYAEMu8E7bUU/yK4byhyQfF9VqZ3OprHOCFWGCxvT uv6KYyZB5GOHx1O2ISM/+wxT0FKl5poW68IiMCe5sdEpQPyP/RPA5ep1tblVDw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1787597344; a=rsa-sha256; cv=none; b=M3AQePDLSaAeLa/dCPELHtCnVHtFBXXXhX6d9kbBQPFhVupSR/O/RjMxO4HZtuX3xsMOf0 lHCj2t9ck81iUS0e3SZgCrpD3v/Odtl3L0/AOHhQSm+gPlfbd92J5jhXGEqaJ9OADSEm9c DPEN8QnDTy2Zl7pxBtmA4W5iAhc3hSKOegTC5J9v7aAO+4dqUfiVaYXJwHaYTvnqKKWSCD npJfTDY3uQ+al1JZDVzqvrXD3GWmQBgV/7snL+HpMhp3+Xt/hi1H9RNVseGHZ1pcAuCMxB 0IsIJfdCArNTxnk5pPa2Z+8Jdz5BHg1B/C8NbACM/5ikG9dE0WWzxO3+U76LxQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787597344; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=f6clmqJ8tFMoE1TpGc3m8FemNT9vAf/1Ssx2pgTZXv4=; b=xTOwx9sZ1/JEoFgCXidkFgYWnosVIcl+1MPGp5QfcmbKM0qc5rD8KNvDUP+eVyQtr1O2Yy sxhjIZRvCs9BlAkga3Rq4TL039ajaHKGKxjSclHN4wt7w5YEor3owKWwq8ymB/hfC9liPX V1Ruq/UUVRq0cA2H5/CRD6O6cocRHX6pQiv0Wib7nT4n7LM5Zh6eFS+bE1KrPcF3NjTNmT tSw8/XirwwMZFpW31dGw8a3HBUxyCvJcaKrFwPb+tZlwvLCY9dzHYMWJGopZHKIFrrw8M/ m0hXisymocLH7rJJ7pPBqXtyJSbtIfuzs/Z70ZBb16HH9bJfyefFR8SPXp4EMw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hTKgz6Slkz2JN for ; Mon, 24 Aug 2026 18:49:03 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 386f2 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 24 Aug 2026 18:49:03 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 9c2ad5b3d10e - stable/14 - netmap: Fix driver name handling List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: 9c2ad5b3d10e639c966cd8dd6664338a40a26bfd Auto-Submitted: auto-generated Date: Mon, 24 Aug 2026 18:49:03 +0000 Message-Id: <6a8c921f.386f2.3bacb58c@gitrepo.freebsd.org> The branch stable/14 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=9c2ad5b3d10e639c966cd8dd6664338a40a26bfd commit 9c2ad5b3d10e639c966cd8dd6664338a40a26bfd Author: Mark Johnston AuthorDate: 2026-08-07 14:46:52 +0000 Commit: Mark Johnston CommitDate: 2026-08-24 18:48:15 +0000 netmap: Fix driver name handling if_initname() requires the caller to ensure that the lifetime of the interface's name buffer contains that of the ifnet itself. netmap_vi_create() wasn't respecting that; we were instead passing the stack-allocated buffer provided by the ioctl handler. While here, add a check to avoid assuming that the caller-provided buffer is nul-terminated. Reported by: syzkaller Reviewed by: vmaffione MFC after: 2 weeks Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D58676 (cherry picked from commit 800d5b7a8a4f5665ced0453e090f8d563366bd47) --- sys/dev/netmap/netmap_kern.h | 3 +++ sys/dev/netmap/netmap_vale.c | 24 ++++++++++++++++++------ 2 files changed, 21 insertions(+), 6 deletions(-) diff --git a/sys/dev/netmap/netmap_kern.h b/sys/dev/netmap/netmap_kern.h index 22bd213d9c42..0e36e00f8e5d 100644 --- a/sys/dev/netmap/netmap_kern.h +++ b/sys/dev/netmap/netmap_kern.h @@ -1014,6 +1014,9 @@ struct netmap_vp_adapter { /* VALE software port */ u_int mfs; /* Last source MAC on this port */ uint64_t last_smac; + + /* Buffer for ifnet driver name */ + char *name; }; diff --git a/sys/dev/netmap/netmap_vale.c b/sys/dev/netmap/netmap_vale.c index 21a067715814..df167912f96f 100644 --- a/sys/dev/netmap/netmap_vale.c +++ b/sys/dev/netmap/netmap_vale.c @@ -1352,6 +1352,7 @@ nm_vi_destroy(const char *name) { if_t ifp; struct netmap_vp_adapter *vpna; + char *viname; int error; ifp = ifunit_ref(name); @@ -1386,9 +1387,12 @@ nm_vi_destroy(const char *name) /* Linux requires all the references are released * before unregister */ + viname = vpna->name; + vpna->name = NULL; netmap_detach(ifp); if_rele(ifp); nm_os_vi_detach(ifp); + nm_os_free(viname); return 0; err: @@ -1420,6 +1424,7 @@ netmap_vi_create(struct nmreq_header *hdr, int autodelete) if_t ifp; struct netmap_vp_adapter *vpna; struct netmap_mem_d *nmd = NULL; + char *name; int error; if (hdr->nr_reqtype != NETMAP_REQ_REGISTER) { @@ -1429,10 +1434,14 @@ netmap_vi_create(struct nmreq_header *hdr, int autodelete) /* don't include VALE prefix */ if (!strncmp(hdr->nr_name, NM_BDG_NAME, strlen(NM_BDG_NAME))) return EINVAL; - if (strlen(hdr->nr_name) >= IFNAMSIZ) { + if (strnlen(hdr->nr_name, sizeof(hdr->nr_name)) >= IFNAMSIZ) return EINVAL; - } - ifp = ifunit_ref(hdr->nr_name); + name = nm_os_malloc(strlen(hdr->nr_name) + 1); + if (name == NULL) + return ENOMEM; + strlcpy(name, hdr->nr_name, strlen(hdr->nr_name) + 1); + + ifp = ifunit_ref(name); if (ifp) { /* already exist, cannot create new one */ error = EEXIST; NMG_LOCK(); @@ -1443,11 +1452,11 @@ netmap_vi_create(struct nmreq_header *hdr, int autodelete) } NMG_UNLOCK(); if_rele(ifp); - return error; + goto err_0; } - error = nm_os_vi_persist(hdr->nr_name, &ifp); + error = nm_os_vi_persist(name, &ifp); if (error) - return error; + goto err_0; NMG_LOCK(); if (req->nr_mem_id) { @@ -1464,6 +1473,7 @@ netmap_vi_create(struct nmreq_header *hdr, int autodelete) nm_prerr("error %d", error); goto err_1; } + vpna->name = name; /* persist-specific routines */ vpna->up.nm_bdg_ctl = netmap_vp_bdg_ctl; if (!autodelete) { @@ -1491,6 +1501,8 @@ err_1: netmap_mem_put(nmd); NMG_UNLOCK(); nm_os_vi_detach(ifp); +err_0: + nm_os_free(name); return error; }