Summary

vke_attach computes the ring size as LOW_POW_2(nmbufs) where nmbufs = nmbclusters / (NetifNum * 2). LOW_POW_2(n) = 1 << (fls(n) - 1). fls(0) returns 0 (cpufunc.h:287), so when nmbufs == 0 this becomes 1 << (0 - 1) = 1 << -1, which is undefined behavior in C (negative shift count on a signed int).

On typical x86/gcc this evaluates to INT_MIN, which is then sign-extended into the size_t ringsize multiplication at line 303 producing a multi-GB kmalloc request that hangs/OOM-panics the vkernel boot.

Root cause

Macro at if_vke.c:89:

#define LOW_POW_2(n) (1 << (fls(n) - 1))

vke_attach at line 832-841: when vke_max_ringsize==0 (default tunable), nmbufs = nmbclusters / (NetifNum * 2) then sc->sc_ringsize = LOW_POW_2(nmbufs).

If nmbclusters is small enough that nmbclusters < NetifNum*2, nmbufs is 0 (integer division), and LOW_POW_2(0) is undefined. fls(0)==0 is confirmed in sys/cpu/x86_64/include/cpufunc.h:285-288 (mask == 0 ? mask : ...).

Downstream in vke_init at line 303: size_t ringsize = sc->sc_ringsize * sizeof(struct mbuf *); — a negative int promoted to size_t becomes ~2^64, multiplied by 8 yields an absurd kmalloc size at lines 322-327 with M_WAITOK (sleeps forever / panics on OOM).

Threat model

Operator-only trigger (PR:H): requires setting kern.ipc.nmbclusters very low at boot AND starting ≥ 1 vke interface. A guest user cannot influence nmbclusters or NetifNum.

Impact is vkernel boot failure / OOM panic — availability only, on the vkernel process. No memory corruption is reachable because the bogus kmalloc size never returns a usable pointer (M_WAITOK either sleeps or panics before the ring is used).

PoC

Host setup: boot the host kernel with kern.ipc.nmbclusters=2 (loader.conf), then launch a vkernel with two interfaces:

vkernel64 -I vke0:/dev/tap1 -I vke1:/dev/tap2 ...

nmbufs = 2/(2*2) = 0, LOW_POW_2(0) = UB.

Success criterion: vkernel boot hangs or panics with kmalloc failure in vke_init. This is a self-DoS for the operator; not reachable by a guest user.

Recommended fix

Defensively floor LOW_POW_2 at 1 and also sanity-check the final sc_ringsize.

--- a/sys/dev/virtual/vkernel/net/if_vke.c
+++ b/sys/dev/virtual/vkernel/net/if_vke.c
@@ -86,7 +86,7 @@ static int vke_max_ringsize = 0;
 TUNABLE_INT("hw.vke.max_ringsize", &vke_max_ringsize);

-#define LOW_POW_2(n)   (1 << (fls(n) - 1))
+#define LOW_POW_2(n)   ((n) <= 1 ? 1 : (1 << (fls(n) - 1)))

 struct vke_softc {
@@ -841,6 +841,10 @@ vke_attach(const struct vknetif_info *info, int unit)
    } else {
        sc->sc_ringsize = LOW_POW_2(VKE_CHUNK);
    }
+   /* Defensive: never allow a ringsize smaller than VKE_CHUNK+1. */
+   if (sc->sc_ringsize < VKE_CHUNK + 1)
+       sc->sc_ringsize = VKE_CHUNK + 1;
+   KKASSERT((sc->sc_ringsize & (sc->sc_ringsize - 1)) == 0);

    ifp = &sc->arpcom.ac_if;

This guarantees LOW_POW_2(0) returns 1 instead of invoking UB, and the post-check ensures the ring is always a valid power of two large enough to make progress.