[Bug 297300] integer wrap in netmap_mem2_rings_create() -> crash

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297300

            Bug ID: 297300
           Summary: integer wrap in netmap_mem2_rings_create() -> crash
           Product: Base System
           Version: CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: kern
          Assignee: bugs@FreeBSD.org
          Reporter: rtm@lcs.mit.edu
 Attachment #273489 text/plain
         mime type:

Created attachment 273489
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=273489&action=edit
cause integer wrap in netmap_mem2_rings_create()

In this from netmap_mem2_rings_create()

                        len = sizeof(struct netmap_ring) +
                                  ndesc * sizeof(struct netmap_slot);
                        ring = netmap_ring_malloc(nmd, len);

ndesc comes from user code via ioctl NIOCCTRL / NETMAP_REQ_REGISTER
(it's nr_rx/tx_slots). If it's too large, the result won't fit in
len's 32 bits.

The attached demo passes in nr_rx_slots = 268435440, which causes len
to be zero, so netmap_ring_malloc() allocates arrays that are too
small. Later, netmap_new_bufs() runs out of buffers and crashes in:

cleanup:
        ...;
        bzero(slot, n * sizeof(slot[0]));

# uname -a
FreeBSD xxx 16.0-CURRENT FreeBSD 16.0-CURRENT #37 main-n275529-da69298e9825:
Fri Jul 17 07:08:15 AST 2026    
root@xxx:/usr/obj/usr/src/amd64.amd64/sys/GENERIC amd64
# cc netmap3e.c
# ./a.out
521.971188 [1041] netmap_obj_malloc         no more netmap_buf objects
521.971733 [1210] netmap_new_bufs           no more buffers after 163838 of
268435440
panic: vm_fault_lookup: fault on nofault entry, addr: 0xfffffe0160642000
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x36/frame 0xfffffe00d744b4a0
vpanic() at vpanic+0x149/frame 0xfffffe00d744b5d0
panic() at panic+0x43/frame 0xfffffe00d744b630
vm_fault() at vm_fault+0x1db6/frame 0xfffffe00d744b7c0
vm_fault_trap() at vm_fault_trap+0x65/frame 0xfffffe00d744b800
trap_pfault() at trap_pfault+0x295/frame 0xfffffe00d744b870
calltrap() at calltrap+0x8/frame 0xfffffe00d744b870
--- trap 0xc, rip = 0xffffffff811d98fe, rsp = 0xfffffe00d744b940, rbp =
0xfffffe00d744b940 ---
memset_erms() at memset_erms+0xde/frame 0xfffffe00d744b940
memset_erms() at memset_erms+0xde/frame 0xfffffe00d744b940
netmap_mem2_rings_create() at netmap_mem2_rings_create+0x457/frame
0xfffffe00d744ba00
netmap_mem_rings_create() at netmap_mem_rings_create+0x37/frame
0xfffffe00d744ba20  
netmap_do_regif() at netmap_do_regif+0x29b/frame 0xfffffe00d744ba70
netmap_ioctl() at netmap_ioctl+0x1228/frame 0xfffffe00d744bb50
freebsd_netmap_ioctl() at freebsd_netmap_ioctl+0x9c/frame 0xfffffe00d744bba0
devfs_ioctl() at devfs_ioctl+0xdc/frame 0xfffffe00d744bc00
VOP_IOCTL_APV() at VOP_IOCTL_APV+0x51/frame 0xfffffe00d744bc30
vn_ioctl() at vn_ioctl+0x16f/frame 0xfffffe00d744bca0
devfs_ioctl_f() at devfs_ioctl_f+0x1e/frame 0xfffffe00d744bcc0
kern_ioctl() at kern_ioctl+0x2bd/frame 0xfffffe00d744bd30
sys_ioctl() at sys_ioctl+0x12f/frame 0xfffffe00d744bdf0
amd64_syscall() at amd64_syscall+0x17c/frame 0xfffffe00d744bf30
fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe00d744bf30
--- syscall (54, FreeBSD ELF64, ioctl), rip = 0x82240348a, rsp = 0x8203d3818,
rbp = 0x8203d38c0 ---

-- 
You are receiving this mail because:
You are the assignee for the bug.