git: 6de818285f06 - main - netmap: Fix a race in kqueue registration

The branch main has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=6de818285f066c6705816674c671761dc09bff90

commit 6de818285f066c6705816674c671761dc09bff90
Author:     Mark Johnston <markj@FreeBSD.org>
AuthorDate: 2026-08-07 14:47:06 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2026-08-07 16:30:24 +0000

    netmap: Fix a race in kqueue registration
    
    We need to acquire the netmap global lock earlier, to avoid racing with
    the NETMAP_REQ_REGISTER ioctl handler.
    
    Reported by:    syzkaller
    Reviewed by:    vmaffione
    MFC after:      2 weeks
    Sponsored by:   The FreeBSD Foundation
    Differential Revision:  https://reviews.freebsd.org/D58677
---
 sys/dev/netmap/netmap_freebsd.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/sys/dev/netmap/netmap_freebsd.c b/sys/dev/netmap/netmap_freebsd.c
index 2241bfc970a6..409b273e6442 100644
--- a/sys/dev/netmap/netmap_freebsd.c
+++ b/sys/dev/netmap/netmap_freebsd.c
@@ -1452,24 +1452,24 @@ netmap_kqfilter(struct cdev *dev, struct knote *kn)
 
 	if (ev != EVFILT_READ && ev != EVFILT_WRITE) {
 		nm_prerr("bad filter request %d", ev);
-		return 1;
+		return EINVAL;
 	}
 	error = devfs_get_cdevpriv((void**)&priv);
 	if (error) {
 		nm_prerr("device not yet setup");
-		return 1;
+		return error;
 	}
+	NMG_LOCK();
 	na = priv->np_na;
 	if (na == NULL) {
+		NMG_UNLOCK();
 		nm_prerr("no netmap adapter for this file descriptor");
-		return 1;
+		return ENOENT;
 	}
 	/* the si is indicated in the priv */
 	si = priv->np_si[(ev == EVFILT_WRITE) ? NR_TX : NR_RX];
-	kn->kn_fop = (ev == EVFILT_WRITE) ?
-		&netmap_wfiltops : &netmap_rfiltops;
+	kn->kn_fop = (ev == EVFILT_WRITE) ? &netmap_wfiltops : &netmap_rfiltops;
 	kn->kn_hook = priv;
-	NMG_LOCK();
 	si->kqueue_users++;
 	nm_prinf("kqueue users for %s: %d", si->mtxname, si->kqueue_users);
 	NMG_UNLOCK();