[Bug 297241] netmap: kernel page fault in netmap_mem_if_delete during descriptor teardown

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D297241

            Bug ID: 297241
           Summary: netmap: kernel page fault in netmap_mem_if_delete
                    during descriptor teardown
           Product: Base System
           Version: 14.4-STABLE
          Hardware: amd64
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: kern
          Assignee: [email protected]
          Reporter: [email protected]

Created attachment 273406
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=3D273406&action=
=3Dedit
inimized six-call syzkaller reproducer for the devfs_kqfilter_f kernel page
fault

A reproducible kernel page fault occurs in devfs_kqfilter_f() when a
  netmap descriptor is registered with kqueue while duplicated file
  descriptors and netmap interface lifetime operations are performed
  concurrently.

  Tested system:

  FreeBSD 14.4-STABLE SYZKALLER amd64
  kern.osreldate: 1404500
  Kernel build date: 2026-05-20
  Tested in a QEMU/KVM virtual machine.

  Panic:

  Fatal trap 12: page fault while in kernel mode
  fault virtual address =3D 0xb0
  fault code =3D supervisor write data, page not present

  Relevant backtrace:

  devfs_kqfilter_f
  kqueue_register
  kqueue_kevent
  kern_kevent_fp
  kern_kevent_generic
  sys_kevent
  amd64_syscall
  fast_syscall_common

  A minimized syzkaller reproducer is:

  r0 =3D openat$netmap(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
  socket$inet6_tcp(0x1c, 0x1, 0x0)
  r1 =3D dup(r0)
  ioctl$NIOCCTRL(r1, 0xc0586997, &(0x7f0000000100)=3D{0xe, 0x1, 0x0,
'vale0:syz1\x00', 0x0, &(0x7f0000000200)=3D@reg=3D{0x0, 0x0, 0x800, 0x800, =
0x2,
0x2, 0x0,
  0x0, 0x0, 0x0, 0x1, 0x20}})
  r2 =3D kqueue()
  kevent(r2, &(0x7f0000000a40)=3D[{0x3, 0xfffffffffffffffe, 0x4087, 0x10000=
00,
0x0, 0x1, [0x8, 0x9, 0x0, 0xffff]}], 0x1, &(0x7f0000000400)=3D[{}], 0x1, 0x=
0)

  Execution settings:

  sandbox: none
  threaded: true
  repeat: true
  procs: 4
  NetDevices: disabled
  NetReset: disabled

  The original fuzzing campaign recorded the same crash eight times.
  Independent syz-repro extraction and minimization produced fourteen
  additional exact-title occurrences. The minimized six-call program also
  reproduces the panic directly with syz-execprog, normally within seconds.

  The canonical syzkaller corpus hash of the minimized reproducer is:

  d4951d904f94b1160756347dfdf9e293624b74e7

  I also checked the relationship with FreeBSD PR 293382. The tested system
  already contains the stable/14 kern_event.c change from commit
  88535adba95d019557b4281c52daa9feccade2fe. In particular, it contains the
  registration-time fget_noref_unlocked() recheck introduced for PR 293382.
  The crash remains reproducible on this post-fix kernel.

  This therefore appears to be a separate netmap/devfs file-lifetime race,
  rather than PR 293382 simply being absent from the tested kernel.

  Expected result:

  Registering a netmap descriptor with kqueue concurrently with descriptor
  teardown should either succeed or return an error without accessing an
  invalid cdev/file object.

  Actual result:

  The kernel performs a write through an invalid pointer in
  devfs_kqfilter_f() and panics.

--=20
You are receiving this mail because:
You are the assignee for the bug.=