kern/56292: panic on adding a vlan interface to bridge member

[s-yamaguchi%iij.ad.jp@localhost]

>Number:         56292
>Category:       kern
>Synopsis:       panic on adding a vlan interface to bridge member
>Confidential:   no
>Severity:       serious
>Priority:       low
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Jul 02 03:10:00 +0000 2021
>Originator:     Shoichi Yamaguchi
>Release:        -current (2021-06-28 20:40 UTC)
>Organization:
Internet Initiative Japan Inc.
>Environment:
NetBSD hidden 9.99.85 NetBSD 9.99.85 (GENERIC) #0: Mon Jun 28 17:52:13 UTC 2021  mkrepro%mkrepro.NetBSD.org@localhost:/usr/src/sys/arch/amd64/compile/GENERIC amd64

>Description:
[ 194.5663314] prevented execution of 0x0 (SMEP)
[ 194.5663314] fatal page fault in supervisor mode
[ 194.5663314] trap type 6 code 0x10 rip 0 cs 0x8 rflags 0x10202 cr2 0 ilevel 0x4 rsp 0xffff8c007887db78
[ 194.5663314] curlwp 0xffffac60a3df0b40 pid 483.483 lowest kstack 0xffff8c00788792c0
[ 194.5663314] panic: trap
[ 194.5663314] cpu0: Begin traceback...
[ 194.5663314] vpanic() at netbsd:vpanic+0x156
[ 194.5663314] device_printf() at netbsd:device_printf
[ 194.5663314] startlwp() at netbsd:startlwp
[ 194.5663314] alltraps() at netbsd:alltraps+0xc3
[ 194.5764958] bridge_ioctl() at netbsd:bridge_ioctl+0x333
[ 194.5764958] doifioctl() at netbsd:doifioctl+0x30e
[ 194.5764958] sys_ioctl() at netbsd:sys_ioctl+0x56d
[ 194.5764958] syscall() at netbsd:syscall+0x196
[ 194.5764958] --- syscall (number 54) ---
[ 194.5764958] netbsd:syscall+0x196:
[ 194.5764958] cpu0: End traceback...
[ 194.5764958] rebooting...

bridge(4) has been changing mtu of the adding interface by calling
ether_ioctl(). The function calls ifp->if_init(), but vlan(4) has 
not use the function pointer. 
>How-To-Repeat:
# ifconfig vlan0 create
# ifconfig vlan0 vlan 1 vlanif iavf0
# ifconfig vlan0 up
# ifconfig bridge0 create
# ifconfig bridge0 mtu 1495
# brconfig bridge0 add vlan0
>Fix:
diff --git a/sys/net/if_bridge.c b/sys/net/if_bridge.c
index 8d639221dae..2fa245e478d 100644
--- a/sys/net/if_bridge.c
+++ b/sys/net/if_bridge.c
@@ -861,7 +861,7 @@ bridge_ioctl_add(struct bridge_softc *sc, void *arg)
                        memset(&ifr, 0, sizeof(ifr));
                        ifr.ifr_mtu = sc->sc_if.if_mtu;
                        IFNET_LOCK(ifs);
-                       error = ether_ioctl(ifs, SIOCSIFMTU, &ifr);
+                       error = ifs->if_ioctl(ifs, SIOCSIFMTU, &ifr);
                        IFNET_UNLOCK(ifs);
                        if (error != 0)
                                goto out;