Page MenuHomeFreeBSD

netmap: Fix driver name handling
ClosedPublic

Authored by markj on Aug 5 2026, 5:37 PM.
Tags
None
Referenced Files
Unknown Object (File)
Sun, Sep 20, 2:55 PM
Unknown Object (File)
Sun, Sep 13, 3:19 PM
Unknown Object (File)
Fri, Sep 11, 10:53 AM
Unknown Object (File)
Thu, Sep 10, 3:53 AM
Unknown Object (File)
Sat, Sep 5, 1:31 PM
Unknown Object (File)
Sat, Sep 5, 1:49 AM
Unknown Object (File)
Fri, Sep 4, 7:37 AM
Unknown Object (File)
Wed, Sep 2, 10:43 AM

Details

Summary

if_initname() requires the caller to ensure that the lifetime of the
interface's name buffer contains that of the ifnet itself.
netmap_vi_create() wasn't respecting that; we were instead passing the
stack-allocated buffer provided by the ioctl handler.

While here, add a check to avoid assuming that the caller-provided
buffer is nul-terminated.

Reported by: syzkaller

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

markj requested review of this revision.Aug 5 2026, 5:37 PM

Thanks, but if netmap owns the allocated string (rather than ifnet), shouldn't we deallocate that on deallocation of the netmap_vp_adapter?

This revision is now accepted and ready to land.Aug 6 2026, 7:05 AM

Free the name buffer in nm_vi_destroy()

This revision now requires review to proceed.Aug 6 2026, 1:55 PM
This revision is now accepted and ready to land.Aug 7 2026, 1:34 PM
This revision was automatically updated to reflect the committed changes.