[Bug 297151] vxlan_ioctl_drvspec() should check for missing vxlan_control_table[] entry

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D297151

            Bug ID: 297151
           Summary: vxlan_ioctl_drvspec() should check for missing
                    vxlan_control_table[] entry
           Product: Base System
           Version: CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: kern
          Assignee: [email protected]
          Reporter: [email protected]
 Attachment #273298 text/plain
         mime type:

Created attachment 273298
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=3D273298&action=
=3Dedit
SIOCSDRVSPEC that causes if_vxlan.c to jump to location zero

In if_vxlan.c, vxlan_ioctl_drvspec() checks that ifd_cmd is not too
large, but should also check that the relevant table entry is not all
NULLs, since there's no entry for ifd_cmd=3D3.

The attached demo causes the kernel to jump to location zero with an
SIOCSDRVSPEC ioctl and ifd_cmd=3D3:

# uname -a
FreeBSD xxx 16.0-CURRENT FreeBSD 16.0-CURRENT #37 main-n275529-da69298e9825:
Fri Jul 17 07:08:15 AST 2026=20=20=20=20
root@xxx:/usr/obj/usr/src/amd64.amd64/sys/GENERIC amd64
# cc ovpn3a.c
# ./a.out
Fatal trap 12: page fault while in kernel mode
panic() at panic+0x43/frame 0xfffffe00d71b79e0
trap_pfault() at trap_pfault+0x449/frame 0xfffffe00d71b7a50
calltrap() at calltrap+0x8/frame 0xfffffe00d71b7a50
--- trap 0xc, rip =3D 0, rsp =3D 0xfffffe00d71b7b28, rbp =3D 0xfffffe00d71b=
7bc0 ---
??() at 0/frame 0xfffffe00d71b7bc0
ifioctl() at ifioctl+0x1009/frame 0xfffffe00d71b7cc0
kern_ioctl() at kern_ioctl+0x2bd/frame 0xfffffe00d71b7d30
sys_ioctl() at sys_ioctl+0x12f/frame 0xfffffe00d71b7df0
amd64_syscall() at amd64_syscall+0x17c/frame 0xfffffe00d71b7f30
fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe00d71b7f30
--- syscall (54, FreeBSD ELF64, ioctl), rip =3D 0x82167348a, rsp =3D 0x820a=
14718,
rbp =3D 0x820a14780 ---

--=20
You are receiving this mail because:
You are the assignee for the bug.=