From nobody Mon Aug 24 16:29:57 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hTGbV3hyBz6pbdk for ; Mon, 24 Aug 2026 16:29:58 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hTGbT6ylGz41RQ for ; Mon, 24 Aug 2026 16:29:57 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787588998; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Wu8YUPCbqJNo/jOKWrqlcPRawSlp0ShtK23rGU2v5DU=; b=b2WJQ+xA+Az85OGTR7R3bMovQuTLatG75/h6vdacD10PtEEBlQNtgItkb1Uh8y9Rj3L8kX niVjBQsRg8KlLvkvrV3D3ZDIkhofmuTpIDOgK/rlWRSDldrkasN3AgAnpCWgicSojFSDJJ JQ/ewb86XsVFGapuK6O1Pp9U0b1O6lNniPQ+uvLnYA8SfgjkMDtZsZd2shUXBiWkJfr/44 uAU0kIC5vy+tDWhzY5P4hkETnJO75U5qLhUjed8jwBaWCm1YnM1SFX8er/i89d5wibxXFF knChizr5f8fP4cBoyGfNO/s6bMhiN/N7AvSoQIl1WlK5jw6Wsxo7MrB2bVxkGA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1787588998; a=rsa-sha256; cv=none; b=sEaMKNiif9sa/0souuGm2/mlrtvHb4abxxvf5ffbSwhLR6FM5HrbeBB0lW9GSL6b0LKfu4 s89SDC7jTZhGM0QUrTJXeVP2W8r5yUwyJ1DyRVJtPdRriIqFKg14ioWANOFsl/LJC/s2ag KqR6bDJhYTD+ykPRuNkWmxneAoKiIQOZPyROnpn5rb/9HPYsMIqYaucikd6jIqNjLBvNZO OpDDs0sCs7QheVbw8bUxwdbohBAcYSYB9DrvoYFI50WnxrAMdkaDiEuoXbeo0y4ps2zwlE n96Py3ckqVGcxSlT9YoEwecb6IrABtYwa/Z7bgN7YQM5bQRAXc15cb89FFx8ow== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787588998; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Wu8YUPCbqJNo/jOKWrqlcPRawSlp0ShtK23rGU2v5DU=; b=YvWa2c3xtd0Bnqyus+Iolxqn4m0MRWWNuacjjlqtPgv5zcUjOmjCuSZv4CJILVB6AHg7/w 0vCVocBPjL5B5nFxhoSPJb8Lv+8q4rxDGYLXzoVTk9A9g45PL7vFWL2+8ons7ofDSKIL09 V6Tu98+oa8yVViXGCEOu6+yOEX/1MCBCB30fBmiDhoUbP4mOc9gaQQDIC37q+XYda6+JpJ DoN09NUk7MvDfbr5RanP2xKgdCuEOW5PsB/yA8/AgA72iQU/Qsq0YLZgQpQQxq1qXpES6C BUeWvhZlekVH9cDJG/YGDTgiw4xP7GVO83EGE/lASJoP+St3ncToDC6HHV3OAw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hTGbT5JDhz1BVr for ; Mon, 24 Aug 2026 16:29:57 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 21e89 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 24 Aug 2026 16:29:57 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: a8bde73c4bde - stable/15 - netmap: Fix driver name handling List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: a8bde73c4bdee4ee6dba3bd85e61346ad76370fe Auto-Submitted: auto-generated Date: Mon, 24 Aug 2026 16:29:57 +0000 Message-Id: <6a8c7185.21e89.11605177@gitrepo.freebsd.org> The branch stable/15 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=a8bde73c4bdee4ee6dba3bd85e61346ad76370fe commit a8bde73c4bdee4ee6dba3bd85e61346ad76370fe Author: Mark Johnston AuthorDate: 2026-08-07 14:46:52 +0000 Commit: Mark Johnston CommitDate: 2026-08-24 15:17:54 +0000 netmap: Fix driver name handling if_initname() requires the caller to ensure that the lifetime of the interface's name buffer contains that of the ifnet itself. netmap_vi_create() wasn't respecting that; we were instead passing the stack-allocated buffer provided by the ioctl handler. While here, add a check to avoid assuming that the caller-provided buffer is nul-terminated. Reported by: syzkaller Reviewed by: vmaffione MFC after: 2 weeks Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D58676 (cherry picked from commit 800d5b7a8a4f5665ced0453e090f8d563366bd47) --- sys/dev/netmap/netmap_kern.h | 3 +++ sys/dev/netmap/netmap_vale.c | 24 ++++++++++++++++++------ 2 files changed, 21 insertions(+), 6 deletions(-) diff --git a/sys/dev/netmap/netmap_kern.h b/sys/dev/netmap/netmap_kern.h index 931bf7cd332b..704b880b3232 100644 --- a/sys/dev/netmap/netmap_kern.h +++ b/sys/dev/netmap/netmap_kern.h @@ -1015,6 +1015,9 @@ struct netmap_vp_adapter { /* VALE software port */ u_int mfs; /* Last source MAC on this port */ uint64_t last_smac; + + /* Buffer for ifnet driver name */ + char *name; }; diff --git a/sys/dev/netmap/netmap_vale.c b/sys/dev/netmap/netmap_vale.c index 21a067715814..df167912f96f 100644 --- a/sys/dev/netmap/netmap_vale.c +++ b/sys/dev/netmap/netmap_vale.c @@ -1352,6 +1352,7 @@ nm_vi_destroy(const char *name) { if_t ifp; struct netmap_vp_adapter *vpna; + char *viname; int error; ifp = ifunit_ref(name); @@ -1386,9 +1387,12 @@ nm_vi_destroy(const char *name) /* Linux requires all the references are released * before unregister */ + viname = vpna->name; + vpna->name = NULL; netmap_detach(ifp); if_rele(ifp); nm_os_vi_detach(ifp); + nm_os_free(viname); return 0; err: @@ -1420,6 +1424,7 @@ netmap_vi_create(struct nmreq_header *hdr, int autodelete) if_t ifp; struct netmap_vp_adapter *vpna; struct netmap_mem_d *nmd = NULL; + char *name; int error; if (hdr->nr_reqtype != NETMAP_REQ_REGISTER) { @@ -1429,10 +1434,14 @@ netmap_vi_create(struct nmreq_header *hdr, int autodelete) /* don't include VALE prefix */ if (!strncmp(hdr->nr_name, NM_BDG_NAME, strlen(NM_BDG_NAME))) return EINVAL; - if (strlen(hdr->nr_name) >= IFNAMSIZ) { + if (strnlen(hdr->nr_name, sizeof(hdr->nr_name)) >= IFNAMSIZ) return EINVAL; - } - ifp = ifunit_ref(hdr->nr_name); + name = nm_os_malloc(strlen(hdr->nr_name) + 1); + if (name == NULL) + return ENOMEM; + strlcpy(name, hdr->nr_name, strlen(hdr->nr_name) + 1); + + ifp = ifunit_ref(name); if (ifp) { /* already exist, cannot create new one */ error = EEXIST; NMG_LOCK(); @@ -1443,11 +1452,11 @@ netmap_vi_create(struct nmreq_header *hdr, int autodelete) } NMG_UNLOCK(); if_rele(ifp); - return error; + goto err_0; } - error = nm_os_vi_persist(hdr->nr_name, &ifp); + error = nm_os_vi_persist(name, &ifp); if (error) - return error; + goto err_0; NMG_LOCK(); if (req->nr_mem_id) { @@ -1464,6 +1473,7 @@ netmap_vi_create(struct nmreq_header *hdr, int autodelete) nm_prerr("error %d", error); goto err_1; } + vpna->name = name; /* persist-specific routines */ vpna->up.nm_bdg_ctl = netmap_vp_bdg_ctl; if (!autodelete) { @@ -1491,6 +1501,8 @@ err_1: netmap_mem_put(nmd); NMG_UNLOCK(); nm_os_vi_detach(ifp); +err_0: + nm_os_free(name); return error; }