[Bug 297151] vxlan_ioctl_drvspec() should check for missing vxlan_control_table[] entry

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297151

            Bug ID: 297151
           Summary: vxlan_ioctl_drvspec() should check for missing
                    vxlan_control_table[] entry
           Product: Base System
           Version: CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: kern
          Assignee: bugs@FreeBSD.org
          Reporter: rtm@lcs.mit.edu
 Attachment #273298 text/plain
         mime type:

Created attachment 273298
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=273298&action=edit
SIOCSDRVSPEC that causes if_vxlan.c to jump to location zero

In if_vxlan.c, vxlan_ioctl_drvspec() checks that ifd_cmd is not too
large, but should also check that the relevant table entry is not all
NULLs, since there's no entry for ifd_cmd=3.

The attached demo causes the kernel to jump to location zero with an
SIOCSDRVSPEC ioctl and ifd_cmd=3:

# uname -a
FreeBSD xxx 16.0-CURRENT FreeBSD 16.0-CURRENT #37 main-n275529-da69298e9825:
Fri Jul 17 07:08:15 AST 2026    
root@xxx:/usr/obj/usr/src/amd64.amd64/sys/GENERIC amd64
# cc ovpn3a.c
# ./a.out
Fatal trap 12: page fault while in kernel mode
panic() at panic+0x43/frame 0xfffffe00d71b79e0
trap_pfault() at trap_pfault+0x449/frame 0xfffffe00d71b7a50
calltrap() at calltrap+0x8/frame 0xfffffe00d71b7a50
--- trap 0xc, rip = 0, rsp = 0xfffffe00d71b7b28, rbp = 0xfffffe00d71b7bc0 ---
??() at 0/frame 0xfffffe00d71b7bc0
ifioctl() at ifioctl+0x1009/frame 0xfffffe00d71b7cc0
kern_ioctl() at kern_ioctl+0x2bd/frame 0xfffffe00d71b7d30
sys_ioctl() at sys_ioctl+0x12f/frame 0xfffffe00d71b7df0
amd64_syscall() at amd64_syscall+0x17c/frame 0xfffffe00d71b7f30
fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe00d71b7f30
--- syscall (54, FreeBSD ELF64, ioctl), rip = 0x82167348a, rsp = 0x820a14718,
rbp = 0x820a14780 ---

-- 
You are receiving this mail because:
You are the assignee for the bug.