Created attachment 273298 [details] SIOCSDRVSPEC that causes if_vxlan.c to jump to location zero In if_vxlan.c, vxlan_ioctl_drvspec() checks that ifd_cmd is not too large, but should also check that the relevant table entry is not all NULLs, since there's no entry for ifd_cmd=3. The attached demo causes the kernel to jump to location zero with an SIOCSDRVSPEC ioctl and ifd_cmd=3: # uname -a FreeBSD xxx 16.0-CURRENT FreeBSD 16.0-CURRENT #37 main-n275529-da69298e9825: Fri Jul 17 07:08:15 AST 2026 root@xxx:/usr/obj/usr/src/amd64.amd64/sys/GENERIC amd64 # cc ovpn3a.c # ./a.out Fatal trap 12: page fault while in kernel mode panic() at panic+0x43/frame 0xfffffe00d71b79e0 trap_pfault() at trap_pfault+0x449/frame 0xfffffe00d71b7a50 calltrap() at calltrap+0x8/frame 0xfffffe00d71b7a50 --- trap 0xc, rip = 0, rsp = 0xfffffe00d71b7b28, rbp = 0xfffffe00d71b7bc0 --- ??() at 0/frame 0xfffffe00d71b7bc0 ifioctl() at ifioctl+0x1009/frame 0xfffffe00d71b7cc0 kern_ioctl() at kern_ioctl+0x2bd/frame 0xfffffe00d71b7d30 sys_ioctl() at sys_ioctl+0x12f/frame 0xfffffe00d71b7df0 amd64_syscall() at amd64_syscall+0x17c/frame 0xfffffe00d71b7f30 fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe00d71b7f30 --- syscall (54, FreeBSD ELF64, ioctl), rip = 0x82167348a, rsp = 0x820a14718, rbp = 0x820a14780 ---
A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=c4d7745cd90fc99af3cbccfda7e11798ea7d187b commit c4d7745cd90fc99af3cbccfda7e11798ea7d187b Author: Pouria Mousavizadeh Tehrani <pouria@FreeBSD.org> AuthorDate: 2026-07-30 13:41:51 +0000 Commit: Pouria Mousavizadeh Tehrani <pouria@FreeBSD.org> CommitDate: 2026-07-30 14:10:36 +0000 if_vxlan(4): Fix panic by validating unused drvspec values Add validation for unused parameter values in the gap between VXLAN_PARAM_WITH_LOCAL_ADDR4 and VXLAN_PARAM_WITH_LOCAL_ADDR6 to prevent panics. PR: 297151 Reported by: Robert Morris <rtm@lcs.mit.edu> Reviewed by: markj MFC after: 3 days Differential Revision: https://reviews.freebsd.org/D58552 sys/net/if_vxlan.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
Thank you for your report and the demo code!
A commit in branch stable/15 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=f923f4739628fc5c80907dad8b69ae9b38269cd0 commit f923f4739628fc5c80907dad8b69ae9b38269cd0 Author: Pouria Mousavizadeh Tehrani <pouria@FreeBSD.org> AuthorDate: 2026-07-30 13:41:51 +0000 Commit: Pouria Mousavizadeh Tehrani <pouria@FreeBSD.org> CommitDate: 2026-08-02 13:19:47 +0000 if_vxlan(4): Fix panic by validating unused drvspec values Add validation for unused parameter values in the gap between VXLAN_PARAM_WITH_LOCAL_ADDR4 and VXLAN_PARAM_WITH_LOCAL_ADDR6 to prevent panics. PR: 297151 Reported by: Robert Morris <rtm@lcs.mit.edu> Reviewed by: markj MFC after: 3 days Differential Revision: https://reviews.freebsd.org/D58552 (cherry picked from commit c4d7745cd90fc99af3cbccfda7e11798ea7d187b) sys/net/if_vxlan.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
A commit in branch stable/14 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=094ed249e2a2b285f8144db2255079bafff36ca3 commit 094ed249e2a2b285f8144db2255079bafff36ca3 Author: Pouria Mousavizadeh Tehrani <pouria@FreeBSD.org> AuthorDate: 2026-07-30 13:41:51 +0000 Commit: Pouria Mousavizadeh Tehrani <pouria@FreeBSD.org> CommitDate: 2026-08-02 13:22:28 +0000 if_vxlan(4): Fix panic by validating unused drvspec values Add validation for unused parameter values in the gap between VXLAN_PARAM_WITH_LOCAL_ADDR4 and VXLAN_PARAM_WITH_LOCAL_ADDR6 to prevent panics. PR: 297151 Reported by: Robert Morris <rtm@lcs.mit.edu> Reviewed by: markj MFC after: 3 days Differential Revision: https://reviews.freebsd.org/D58552 (cherry picked from commit c4d7745cd90fc99af3cbccfda7e11798ea7d187b) (cherry picked from commit f923f4739628fc5c80907dad8b69ae9b38269cd0) sys/net/if_vxlan.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)