Bug 297220 - infinite recursion in pfi_kkif_update()
Summary: infinite recursion in pfi_kkif_update()
Status: New
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: 16.0-CURRENT
Hardware: Any Any
: --- Affects Some People
Assignee: freebsd-net (Nobody)
URL:
Keywords: crash
Depends on:
Blocks:
 
Reported: 2026-08-01 10:26 UTC by Robert Morris
Modified: 2026-08-11 08:43 UTC (History)
4 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Robert Morris 2026-08-01 10:26:49 UTC
This command sequence causes infinite recursion in pfi_kkif_update(),
so it runs out of stack:

# kldload if_wg
# kldload pf
# ifconfig wg0 create
# ifconfig wg0 name wg
Fatal double fault
rip 0xffffffff82e6a2b6 rsp 0xfffffe00d71aefe0 rbp 0xfffffe00d71af030
rax 0x1f91c764d934a9f6 rdx 0 rbx 0xfffff80019d23900
rcx 0xfffff800191e7100 rsi 0xffffffff8220bf80 rdi 0xfffff800191e7100
r8 0xfffff800556cd5c8 r9 0x1a10010 r10 0
r11 0x1 r12 0xffffffff81b99828 r13 0xffffffff81b99828
r14 0 r15 0xfffff8000f289000 rflags 0x10282
cs 0x20 ss 0x28 ds 0x3b es 0x3b fs 0x13 gs 0x1b
fsbase 0x397eefe143b0 gsbase 0xffffffff82a11000 kgsbase 0
cpuid = 1; apic id = 01
panic: double fault
cpuid = 1
time = 1785578874
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x36/frame 0xfffffe001c472cd0
vpanic() at vpanic+0x149/frame 0xfffffe001c472e00
panic() at panic+0x43/frame 0xfffffe001c472e60
cpu_fetch_syscall_args() at cpu_fetch_syscall_args/frame 0xfffffe001c472f20
Xdblfault() at Xdblfault+0xd7/frame 0xfffffe001c472f20
--- trap 0x17, rip = 0xffffffff82e6a2b6, rsp = 0xfffffe00d71aefe0, rbp = 0xfffffe00d71af030 ---
pfi_kkif_update() at pfi_kkif_update+0x26/frame 0xfffffe00d71af030
pfi_kkif_update() at pfi_kkif_update+0x2ba/frame 0xfffffe00d71af090
pfi_kkif_update() at pfi_kkif_update+0x2ba/frame 0xfffffe00d71af0f0
pfi_kkif_update() at pfi_kkif_update+0x2ba/frame 0xfffffe00d71af150
pfi_kkif_update() at pfi_kkif_update+0x2ba/frame 0xfffffe00d71af1b0
pfi_kkif_update() at pfi_kkif_update+0x2ba/frame 0xfffffe00d71af210
...
pfi_kkif_update() at pfi_kkif_update+0x2ba/frame 0xfffffe00d71b29f0
pfi_attach_ifnet_event() at pfi_attach_ifnet_event+0x91/frame 0xfffffe00d71b2a50
if_rename() at if_rename+0x203/frame 0xfffffe00d71b2ad0
ifhwioctl() at ifhwioctl+0xc57/frame 0xfffffe00d71b2bc0
ifioctl() at ifioctl+0x702/frame 0xfffffe00d71b2cc0
kern_ioctl() at kern_ioctl+0x2bd/frame 0xfffffe00d71b2d30
sys_ioctl() at sys_ioctl+0x12f/frame 0xfffffe00d71b2df0
amd64_syscall() at amd64_syscall+0x17c/frame 0xfffffe00d71b2f30
fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe00d71b2f30
--- syscall (54, FreeBSD ELF64, ioctl), rip = 0xff79713d48a, rsp = 0xff790379a78, rbp = 0xff790379ad0 ---
Comment 1 Kristof Provost freebsd_committer freebsd_triage 2026-08-01 16:41:24 UTC
The root problem here is arguably not in pf but in the network stack interface rename code. 
Pf assumes that network groups and network interfaces share a namespace. This used to be true, but the assumption was broken when renaming interfaces was introduced. 
That’s what causes the confusion here, and the panic. 
I thought I’d hacked it up enough to at least avoid the panic, but clearly there are still broken scenarios. 

I’ll see if I can at least avoid the panic, but realistically the behaviour will still be buggy until the network stack itself is fixed. 

(There are other bug reports about this, but I don’t have the numbers at hand.)
Comment 2 commit-hook freebsd_committer freebsd_triage 2026-08-03 16:02:42 UTC
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=d2a5b5a86a92e86f77737273ab4b2e99da63c21d

commit d2a5b5a86a92e86f77737273ab4b2e99da63c21d
Author:     Kristof Provost <kp@FreeBSD.org>
AuthorDate: 2026-08-03 14:05:28 +0000
Commit:     Kristof Provost <kp@FreeBSD.org>
CommitDate: 2026-08-03 16:01:52 +0000

    pf: attempt to handle overlapping group and interface names

    pf assumes that network groups and network interfaces share a namespace
    (that is, a name is unused, a group or an interface, never both a the
    same time). Unfortunately this assumption was broken when interface
    renaming was introduced.
    Attempt to cope with this rather than panicking. Note that this is a
    band-aid, not a full solution. The correct fix is for the network stack
    to go back to enforcing a single namespace for groups and interfaces.

    PR:             297220
    Reported by:    Robert Morris
    MFC after:      1 week
    Sponsored by:   Rubicon Communications, LLC ("Netgate")

 sys/netpfil/pf/pf_if.c        | 19 +++++++++++++------
 tests/sys/netpfil/pf/names.sh | 23 +++++++++++++++++++++++
 2 files changed, 36 insertions(+), 6 deletions(-)
Comment 3 commit-hook freebsd_committer freebsd_triage 2026-08-11 08:43:15 UTC
A commit in branch stable/15 references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=80d732d6409907efb586c621238f5c43c77690f8

commit 80d732d6409907efb586c621238f5c43c77690f8
Author:     Kristof Provost <kp@FreeBSD.org>
AuthorDate: 2026-08-03 14:05:28 +0000
Commit:     Kristof Provost <kp@FreeBSD.org>
CommitDate: 2026-08-11 08:33:56 +0000

    pf: attempt to handle overlapping group and interface names

    pf assumes that network groups and network interfaces share a namespace
    (that is, a name is unused, a group or an interface, never both a the
    same time). Unfortunately this assumption was broken when interface
    renaming was introduced.
    Attempt to cope with this rather than panicking. Note that this is a
    band-aid, not a full solution. The correct fix is for the network stack
    to go back to enforcing a single namespace for groups and interfaces.

    PR:             297220
    Reported by:    Robert Morris
    MFC after:      1 week
    Sponsored by:   Rubicon Communications, LLC ("Netgate")

    (cherry picked from commit d2a5b5a86a92e86f77737273ab4b2e99da63c21d)

 sys/netpfil/pf/pf_if.c        | 19 +++++++++++++------
 tests/sys/netpfil/pf/names.sh | 23 +++++++++++++++++++++++
 2 files changed, 36 insertions(+), 6 deletions(-)
Comment 4 commit-hook freebsd_committer freebsd_triage 2026-08-11 08:43:17 UTC
A commit in branch stable/14 references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=71ac7ff5d6f97d0f49b72922bcaca191ff7677d2

commit 71ac7ff5d6f97d0f49b72922bcaca191ff7677d2
Author:     Kristof Provost <kp@FreeBSD.org>
AuthorDate: 2026-08-03 14:05:28 +0000
Commit:     Kristof Provost <kp@FreeBSD.org>
CommitDate: 2026-08-11 08:34:13 +0000

    pf: attempt to handle overlapping group and interface names

    pf assumes that network groups and network interfaces share a namespace
    (that is, a name is unused, a group or an interface, never both a the
    same time). Unfortunately this assumption was broken when interface
    renaming was introduced.
    Attempt to cope with this rather than panicking. Note that this is a
    band-aid, not a full solution. The correct fix is for the network stack
    to go back to enforcing a single namespace for groups and interfaces.

    PR:             297220
    Reported by:    Robert Morris
    MFC after:      1 week
    Sponsored by:   Rubicon Communications, LLC ("Netgate")

    (cherry picked from commit d2a5b5a86a92e86f77737273ab4b2e99da63c21d)

 sys/netpfil/pf/pf_if.c        | 19 +++++++++++++------
 tests/sys/netpfil/pf/names.sh | 23 +++++++++++++++++++++++
 2 files changed, 36 insertions(+), 6 deletions(-)