[Bug 297148] SIOCGETSGCNT before MRT_INIT yields kernel crash

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D297148

            Bug ID: 297148
           Summary: SIOCGETSGCNT before MRT_INIT yields kernel crash
           Product: Base System
           Version: CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: kern
          Assignee: [email protected]
          Reporter: [email protected]
 Attachment #273294 text/plain
         mime type:

Created attachment 273294
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=3D273294&action=
=3Dedit
SIOCGETSGCNT before MRT_INIT causes a crash

If SIOCGETSGCNT is called before the multicast routing system
is initialized, mfc_find() will dereference a MULL mfchashtbl in

        LIST_FOREACH(rt, &mfct->mfchashtbl[MFCHASH(*o, *g)], mfc_hash) {

The attached demo:

# uname -a
FreeBSD xxx 16.0-CURRENT FreeBSD 16.0-CURRENT #37 main-n275529-da69298e9825:
Fri Jul 17 07:08:15 AST 2026=20=20=20=20
root@xxx:/usr/obj/usr/src/amd64.amd64/sys/GENERIC amd64
# cc ovpn1a.c
# ./a.out
Kernel page fault with the following non-sleepable locks held:
shared rw IPv4 multicast forwarding (IPv4 multicast forwarding) r =3D 0
(0xfffffff
f82e1aa40) locked @ /usr/src/sys/netinet/ip_mroute.c:594
stack backtrace:
#0 0xffffffff80c8f79c at witness_debugger+0x6c
#1 0xffffffff80c9109c at witness_warn+0x4bc
#2 0xffffffff811dd7f7 at trap_pfault+0x97
#3 0xffffffff811abde8 at calltrap+0x8
#4 0xffffffff80ca2ac8 at soo_ioctl+0x3c8
#5 0xffffffff80c9674d at kern_ioctl+0x2bd
#6 0xffffffff80c9642f at sys_ioctl+0x12f
#7 0xffffffff811de26c at amd64_syscall+0x17c
#8 0xffffffff811ac6db at fast_syscall_common+0xf8


Fatal trap 12: page fault while in kernel mode
panic: page fault
--- trap 0xc, rip =3D 0xffffffff82e169c1, rsp =3D 0xfffffe00d754fc60, rbp =
=3D
0xfffffe00d754fc90 ---
X_mrt_ioctl() at X_mrt_ioctl+0x171/frame 0xfffffe00d754fc90
soo_ioctl() at soo_ioctl+0x3c8/frame 0xfffffe00d754fcc0
kern_ioctl() at kern_ioctl+0x2bd/frame 0xfffffe00d754fd30
sys_ioctl() at sys_ioctl+0x12f/frame 0xfffffe00d754fdf0
amd64_syscall() at amd64_syscall+0x17c/frame 0xfffffe00d754ff30
fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe00d754ff30
--- syscall (54, FreeBSD ELF64, ioctl), rip =3D 0x8216c348a, rsp =3D 0x820a=
4c0f8,
rbp =3D 0x820a4c160 ---

--=20
You are receiving this mail because:
You are the assignee for the bug.=