From nobody Mon Jun 24 14:53:52 2024 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4W79vj32Jtz5P2rY; Mon, 24 Jun 2024 14:53:53 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4W79vh612Tz48cD; Mon, 24 Jun 2024 14:53:52 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1719240832; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=uDU7sxxYaCd+27HwntGSHtc10EHVUHxG64pozCj/CNU=; b=yxfMaBghIN6URZbtFYSsDJp+ASesBopj1sivKVyfkrcRuFrgC0iwepi7MGgfwBQK39WvWi tSZ80ULdxYv4wzTt01AnBj3iLAkraO51TKaqdo6pf5mBeoqOydT/SwXiBg7E5GNmEHqHms +GC1AR/+5Fi44g9qv63MgspboVhj4U36HctFkHvFLP9y1s6TrToI0ModiBYQuCJHHPxwrW sxbXh/D9LizgHO0aTprVSNSsIzSyRNvfp7FODEq2oFZYGuR9SPUsTyO7jyk9ngX7h//KkN HcoqrMn5zCSequSIofVm7MTj3Dltipyq++HI9EfLsuLaYwz5Rw9xg7sCiKciYA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1719240832; a=rsa-sha256; cv=none; b=gN6/yZ6BBLnIjmh0wODP29lJcWEyXQ622bgYx/6YbuNJ9kpiJBR2+KOdgfUDSrxHm0RkXW chm80V0Ce2YGvAIk1AhFXQTRF5Su+CiN64whkhJEPhG2bNWICh6w7qBhT0xXbanIqwfiaZ 7SRDEQRP7SusterLjZZWqfqFnMct0EjywzfQefVD0wyaNA8Dz1jgyamniekJ7D6dCbW1RM aHchG4UbJ7d/I7fsSgJKQ5aeB+G9gO3bzP05rP5r7TpzGXA7LhHBRIzLHAQxZZrXkKyyyP XXTEoIDBw8blW35ig8sxOAmQGamxXZD36dmSalY1Kte9LCpTUts7azSfF8pUdw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1719240832; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=uDU7sxxYaCd+27HwntGSHtc10EHVUHxG64pozCj/CNU=; b=E/oTC2Ip5KCZ5ldByQrqPYEYyZgRg9Y7nWhRov5Jj78O+WaIxDStuJYc/DfnIUwDhsBhdr ZrVWBaildZRRLtief7XvjGy1g8e/mXyFqUaJfZWfjNb14Yd6o52e6pBKIet0YbEPvo7iA6 ng4tM96FxnoP6LH2zzSbBFNnyCDRrbyV/+meqkFNb/ai4OkadkgsKbjkbR5ITi1j3R2KbI 7oYTE5EhBGBWxInM1yVnySVJMEEnhih2frl77Y9S9vamUsjU3ie7DVa9vriBbXc1VzMbSd GEXLEAQCAFvPNzLTHkMpqtNN/I4pKSZ/plSoZannvbxVjMVUb0eNQJSSroV6+A== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4W79vh4kYCzN4T; Mon, 24 Jun 2024 14:53:52 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.17.1/8.17.1) with ESMTP id 45OErq81004703; Mon, 24 Jun 2024 14:53:52 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.17.1/8.17.1/Submit) id 45OErqHO004700; Mon, 24 Jun 2024 14:53:52 GMT (envelope-from git) Date: Mon, 24 Jun 2024 14:53:52 GMT Message-Id: <202406241453.45OErqHO004700@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Mark Johnston Subject: git: 02cbf9ebf110 - main - lagg: Fix a teardown race List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 02cbf9ebf110c94ec9e60f0801716ff0a75e55e5 Auto-Submitted: auto-generated The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=02cbf9ebf110c94ec9e60f0801716ff0a75e55e5 commit 02cbf9ebf110c94ec9e60f0801716ff0a75e55e5 Author: Mark Johnston AuthorDate: 2024-06-24 14:47:29 +0000 Commit: Mark Johnston CommitDate: 2024-06-24 14:47:29 +0000 lagg: Fix a teardown race When a lagg interface is destroyed, it destroys all of the lagg ports, which triggers an asynchronous link state change handler. This in turn may generate a netlink message, a portion of which requires netlink to invoke the SIOCGIFMEDIA ioctl of the lagg interface, which involves scanning the list of interface media. This list is not internally locked, it requires the interface driver to provide some kind of synchronization. Shortly after the link state notification has been raised, the lagg interface detaches itself from the network stack. As a part of this, it blocks in order to wait for link state handlers to drain, but before that it destroys the interface media list. Reverse this order of operations so that the link state change handlers drain first, avoiding a use-after-free that is very occasionally triggered by lagg stress tests. This matches other ethernet drivers in the tree. MFC after: 2 weeks --- sys/net/if_lagg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/net/if_lagg.c b/sys/net/if_lagg.c index bb882ac819ad..e323bb01b977 100644 --- a/sys/net/if_lagg.c +++ b/sys/net/if_lagg.c @@ -643,8 +643,8 @@ lagg_clone_destroy(struct if_clone *ifc, struct ifnet *ifp, uint32_t flags) switch (ifp->if_type) { case IFT_ETHER: - ifmedia_removeall(&sc->sc_media); ether_ifdetach(ifp); + ifmedia_removeall(&sc->sc_media); break; case IFT_INFINIBAND: infiniband_ifdetach(ifp);