[Bug 297436] netmap: signed nr_port_idx causes out-of-bounds access in netmap_vale_list()

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297436

--- Comment #8 from 王雪阳 <yangyang20250212@163.com> ---
Additional reproduction: FreeBSD 14.4-RELEASE GENERIC amd64

I have successfully reproduced a kernel panic using the original Bug 297436
ioctl request on FreeBSD 14.4-RELEASE with the GENERIC amd64 kernel, without
using the previously reported SYZKALLER kernel configuration.

**Tested environment**

* OS: FreeBSD 14.4-RELEASE
* Architecture: amd64
* Kernel: GENERIC
* Source identification: releng/14.4-n273675-a456f852d145
* kern.osreldate: 1404000
* Execution privileges: root
* Device: /dev/netmap (root:wheel, mode 0600)

**Reproduction**

The original native C reproducer (attachment 273622) was used with the same
request parameters:

* ioctl: NIOCCTRL
* Request type: NETMAP_REQ_VALE_LIST
* nr_port_idx: 0x80000000

The reproducer required the addition of `#include <net/if.h>` to compile on
this release. No ioctl request fields or trigger values were changed.

**Observed result**

A kernel panic occurred on the first execution:

```
panic: page fault
```

The recorded stack trace includes `netmap_ioctl`.

This demonstrates that the same malformed netmap ioctl request can trigger a
kernel page fault on a FreeBSD 14.4-RELEASE GENERIC installation, independently
of the original SYZKALLER kernel configuration.

The RELEASE stack trace does not separately identify a `netmap_vale_list()`
frame. Therefore, although the observed failure is consistent with the original
report and the affected source code contains the same signed-index flaw, the
exact faulting instruction in this RELEASE kernel has not yet been
independently symbolized.

**Security impact**

The confirmed consequence is a kernel panic resulting in system-wide denial of
service.

The reproduction was performed as root. Unprivileged-user testing has not
established a successful trigger. Privilege escalation, information disclosure,
and remote exploitability have not been demonstrated.

I will attach the corresponding panic screenshot and RELEASE validation record.

Given the confirmation on a standard RELEASE kernel, I would appreciate further
review of the security impact and the proposed fix (attachment 273715),
including consideration for CVE assignment.

-- 
You are receiving this mail because:
You are the assignee for the bug.