Re: git: 956acdce0505 - main - loopback: Account for packet drops

On 14 Apr 2026, at 21:47, Andrew Gallatin wrote:
> The branch main has been updated by gallatin:
>
> URL: https://cgit.FreeBSD.org/src/commit/?id=956acdce0505ca8028d287d3b44789c623c8f37e
>
> commit 956acdce0505ca8028d287d3b44789c623c8f37e
> Author:     Andrew Gallatin <gallatin@FreeBSD.org>
> AuthorDate: 2026-04-14 19:43:28 +0000
> Commit:     Andrew Gallatin <gallatin@FreeBSD.org>
> CommitDate: 2026-04-14 19:43:28 +0000
>
>     loopback: Account for packet drops
>
>     Make loopback packet drops more obvious by reporting them
>     in interface stats visable via netstat -ni
>     Since loopback uses netisr, packets can be dropped if the
>     netisr queue overflows.  These drops are visible via
>     netisr -Q, but its not an obvious place to look.
>
>     Differential Revision: https://reviews.freebsd.org/D56356
>     Reviewed by: glebius, tuexen
>     Sponsored by: Netflix
> ---
>  sys/net/if_loop.c | 10 +++++++---
>  1 file changed, 7 insertions(+), 3 deletions(-)
>
> diff --git a/sys/net/if_loop.c b/sys/net/if_loop.c
> index 37309260a0d3..2ff265d5d1e7 100644
> --- a/sys/net/if_loop.c
> +++ b/sys/net/if_loop.c
> @@ -350,9 +350,13 @@ if_simloop(struct ifnet *ifp, struct mbuf *m, int af, int hlen)
>  		m_freem(m);
>  		return (EAFNOSUPPORT);
>  	}
> -	if_inc_counter(ifp, IFCOUNTER_IPACKETS, 1);
> -	if_inc_counter(ifp, IFCOUNTER_IBYTES, m->m_pkthdr.len);
> -	netisr_queue(isr, m);	/* mbuf is free'd on failure. */
> +	if (netisr_queue(isr, m) == 0) {
> +		if_inc_counter(ifp, IFCOUNTER_IPACKETS, 1);
> +		if_inc_counter(ifp, IFCOUNTER_IBYTES, m->m_pkthdr.len);

I’m seeing reproducible KASAN use-after-free warnings here (running the pf tests).
Which makes sense, because after the netisr_queue() call we no longer own the mbuf.

I think we need something like this:

	diff --git a/sys/net/if_loop.c b/sys/net/if_loop.c
	index 2ff265d5d1e7..33ddd3a8540e 100644
	--- a/sys/net/if_loop.c
	+++ b/sys/net/if_loop.c
	@@ -276,6 +276,7 @@ int
	 if_simloop(struct ifnet *ifp, struct mbuf *m, int af, int hlen)
	 {
	        int isr;
	+       int32_t len;

	        M_ASSERTPKTHDR(m);
	        m_tag_delete_nonpersistent(m);
	@@ -350,9 +351,10 @@ if_simloop(struct ifnet *ifp, struct mbuf *m, int af, int hlen)
	                m_freem(m);
	                return (EAFNOSUPPORT);
	        }
	+       len = m->m_pkthdr.len;
	        if (netisr_queue(isr, m) == 0) {
	                if_inc_counter(ifp, IFCOUNTER_IPACKETS, 1);
	-               if_inc_counter(ifp, IFCOUNTER_IBYTES, m->m_pkthdr.len);
	+               if_inc_counter(ifp, IFCOUNTER_IBYTES, len);
	        } else {
	                /* mbuf is free'd on failure. */
	                if_inc_counter(ifp, IFCOUNTER_IQDROPS, 1);

Best regards,
Kristof