From nobody Fri Aug 7 16:30:35 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hGqQB0Rj8z6nMDc for ; Fri, 07 Aug 2026 16:30:42 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hGqQ90LJfz41fC for ; Fri, 07 Aug 2026 16:30:41 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1786120241; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=athxsXQjvFs4dCZL21oJSIU5RN0GS5keHYSnpJAzDtI=; b=DIfYk1cz+8BsJw7y5v167Y4ZI+0ONcy7csG8+168nXS4ZRZGGP5JN3/TDCkdtfZ3gy9w++ id2FI26l6EaIe8w555TUI6yHt627+BxkXqNS9mrMbzSdxG8sSfktX24fW43uzq3b0yDMwQ elgyPDWHOy+QbItN093aPJ7toYO3E7HuiEIn7jCkxDh83IvDIjuzGMQxBXNBPyJ/Us7QZy RhEgFl91hKb0Xhf+uuxqnqTWDNTi2nZ/IDRIkcUMOD0cqx9tFs14dUkN6scG8r7OUzbsh2 ZMFdBw8i0JzjHHBIEMA3OEHo/TDn83eeTB3wUolRIB9L6KEno8wBEKZy5hEUKA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1786120241; a=rsa-sha256; cv=none; b=iuE/hbVwhRKMklp4RMvQArZYdQ5V3HPdQNwsEk1NeJeRJ0aymrHLXXfe35pbquQXpBs0w3 M8XXK88O3jF8lovwcdJARBxLSMcw4I/rMh9b9RJr1J8EcEl6SCjUL4RczHupwlvWMqUTaD u427XQFNtTanjXzZp/FmUtYfE6T0ffrFpmibwERA1pj3rYOE5yF1oCUezOV5NzuwR5oI6p DDiwZ1cAU3Ab0t9uMh3QVrGsX8Zb3+HxMQq7QjjBo35ws1NiglzNx6FPkIDsyxQ1+ixn1O YJ+IzNYUAJWiux6ddMtPn8vbo1kUavnuw0kiPWTfM23ZU7F8rtM6Af9/HS7WwA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1786120241; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=athxsXQjvFs4dCZL21oJSIU5RN0GS5keHYSnpJAzDtI=; b=WuWZ/z/RJ7I9GqFXRYldc+/NACINVnZ5cf7fYmTLtCgPLD21Uy8UvuSArVfsNXyA+Epl5H H7YIi0QGXh8/oSI6ADsThMZP00r8BukTDogxOdZnJei1oKtjJxSwVoIRGVneLQUuqBRRW0 Pl9ihJrzVPLoaPw+/1l0js5EPzV2zKdcOY1T8kiZVHm4YsZ/BCgYIBY55yCw57f06Wz4xb jLTtnziZp0aBcYh1B9BXkafLpk8muNbW6OFcIGaowVe0J7qiDZcNVwsGdqZx9Kq4LCMvuo M+kHQh0nlzoY3f42a6qu3AWKhS5gQk/E+Mb35so1ue5KqptxEw+3sfcBnN+XAQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hGqQ851gQz1Dxs for ; Fri, 07 Aug 2026 16:30:40 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 2234d by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Fri, 07 Aug 2026 16:30:35 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Mark Johnston Subject: git: 800d5b7a8a4f - main - netmap: Fix driver name handling List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 800d5b7a8a4f5665ced0453e090f8d563366bd47 Auto-Submitted: auto-generated Date: Fri, 07 Aug 2026 16:30:35 +0000 Message-Id: <6a76082b.2234d.56a80c@gitrepo.freebsd.org> The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=800d5b7a8a4f5665ced0453e090f8d563366bd47 commit 800d5b7a8a4f5665ced0453e090f8d563366bd47 Author: Mark Johnston AuthorDate: 2026-08-07 14:46:52 +0000 Commit: Mark Johnston CommitDate: 2026-08-07 16:30:24 +0000 netmap: Fix driver name handling if_initname() requires the caller to ensure that the lifetime of the interface's name buffer contains that of the ifnet itself. netmap_vi_create() wasn't respecting that; we were instead passing the stack-allocated buffer provided by the ioctl handler. While here, add a check to avoid assuming that the caller-provided buffer is nul-terminated. Reported by: syzkaller Reviewed by: vmaffione MFC after: 2 weeks Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D58676 --- sys/dev/netmap/netmap_kern.h | 3 +++ sys/dev/netmap/netmap_vale.c | 24 ++++++++++++++++++------ 2 files changed, 21 insertions(+), 6 deletions(-) diff --git a/sys/dev/netmap/netmap_kern.h b/sys/dev/netmap/netmap_kern.h index 931bf7cd332b..704b880b3232 100644 --- a/sys/dev/netmap/netmap_kern.h +++ b/sys/dev/netmap/netmap_kern.h @@ -1015,6 +1015,9 @@ struct netmap_vp_adapter { /* VALE software port */ u_int mfs; /* Last source MAC on this port */ uint64_t last_smac; + + /* Buffer for ifnet driver name */ + char *name; }; diff --git a/sys/dev/netmap/netmap_vale.c b/sys/dev/netmap/netmap_vale.c index 21a067715814..df167912f96f 100644 --- a/sys/dev/netmap/netmap_vale.c +++ b/sys/dev/netmap/netmap_vale.c @@ -1352,6 +1352,7 @@ nm_vi_destroy(const char *name) { if_t ifp; struct netmap_vp_adapter *vpna; + char *viname; int error; ifp = ifunit_ref(name); @@ -1386,9 +1387,12 @@ nm_vi_destroy(const char *name) /* Linux requires all the references are released * before unregister */ + viname = vpna->name; + vpna->name = NULL; netmap_detach(ifp); if_rele(ifp); nm_os_vi_detach(ifp); + nm_os_free(viname); return 0; err: @@ -1420,6 +1424,7 @@ netmap_vi_create(struct nmreq_header *hdr, int autodelete) if_t ifp; struct netmap_vp_adapter *vpna; struct netmap_mem_d *nmd = NULL; + char *name; int error; if (hdr->nr_reqtype != NETMAP_REQ_REGISTER) { @@ -1429,10 +1434,14 @@ netmap_vi_create(struct nmreq_header *hdr, int autodelete) /* don't include VALE prefix */ if (!strncmp(hdr->nr_name, NM_BDG_NAME, strlen(NM_BDG_NAME))) return EINVAL; - if (strlen(hdr->nr_name) >= IFNAMSIZ) { + if (strnlen(hdr->nr_name, sizeof(hdr->nr_name)) >= IFNAMSIZ) return EINVAL; - } - ifp = ifunit_ref(hdr->nr_name); + name = nm_os_malloc(strlen(hdr->nr_name) + 1); + if (name == NULL) + return ENOMEM; + strlcpy(name, hdr->nr_name, strlen(hdr->nr_name) + 1); + + ifp = ifunit_ref(name); if (ifp) { /* already exist, cannot create new one */ error = EEXIST; NMG_LOCK(); @@ -1443,11 +1452,11 @@ netmap_vi_create(struct nmreq_header *hdr, int autodelete) } NMG_UNLOCK(); if_rele(ifp); - return error; + goto err_0; } - error = nm_os_vi_persist(hdr->nr_name, &ifp); + error = nm_os_vi_persist(name, &ifp); if (error) - return error; + goto err_0; NMG_LOCK(); if (req->nr_mem_id) { @@ -1464,6 +1473,7 @@ netmap_vi_create(struct nmreq_header *hdr, int autodelete) nm_prerr("error %d", error); goto err_1; } + vpna->name = name; /* persist-specific routines */ vpna->up.nm_bdg_ctl = netmap_vp_bdg_ctl; if (!autodelete) { @@ -1491,6 +1501,8 @@ err_1: netmap_mem_put(nmd); NMG_UNLOCK(); nm_os_vi_detach(ifp); +err_0: + nm_os_free(name); return error; }