Bug 295129 - if_geneve.c geneve_udp_input() can use ifp before it is set
Summary: if_geneve.c geneve_udp_input() can use ifp before it is set
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: CURRENT
Hardware: Any Any
: --- Affects Some People
Assignee: Pouria Mousavizadeh Tehrani
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2026-05-09 18:39 UTC by Robert Morris
Modified: 2026-05-10 19:41 UTC (History)
1 user (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Robert Morris 2026-05-09 18:39:33 UTC 
geneve_udp_input() has a few "goto out" before it sets ifp, but the
"out" code passes ifp to if_inc_counter(), which can crash due to
ifp holding garbage.
Comment 1 Pouria Mousavizadeh Tehrani freebsd_committer freebsd_triage 2026-05-10 19:41:51 UTC 
Thank you for your report.
Comment 2 commit-hook freebsd_committer freebsd_triage 2026-05-10 19:41:53 UTC 
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=70ef02b5d3fdbc4f51ea81404c4cbca310083ce6

commit 70ef02b5d3fdbc4f51ea81404c4cbca310083ce6
Author:     Pouria Mousavizadeh Tehrani <pouria@FreeBSD.org>
AuthorDate: 2026-05-10 19:25:53 +0000
Commit:     Pouria Mousavizadeh Tehrani <pouria@FreeBSD.org>
CommitDate: 2026-05-10 19:38:52 +0000

    if_geneve: Fix uninitialized variable use in geneve_udp_input()

    Set the ifp variable as soon as soft_c becomes available
    so that interface statistics can be incremented.

    PR:             295129
    Reported by:    Robert Morris <rtm@lcs.mit.edu>
    Fixes:          e44d2e941e8e ("if_geneve: Add Support for Geneve ...")

 sys/net/if_geneve.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)