From nobody Mon Mar 30 16:02:12 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4fkwxQ1bthz6Whfv for ; Mon, 30 Mar 2026 16:02:18 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R12" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4fkwxP6Q7Wz470V for ; Mon, 30 Mar 2026 16:02:17 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1774886537; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=g863N5nPu3sdp8yoWgaapcFfuXv8W4PyiaKyuRJXXto=; b=r5w4CVC8/lM8BqF7uyXraE/5J9AhX3InRsUC5oCZ6pdxe0VTlDCK/UM4PJ9pKUj7FVGok0 pqhqzxVDO1ZdAE3g89qtzxXq4KzKaeYUq2jRVvRMn1FFuPGFtqpRwdtm6aeB+abGUuHRQh 0/DMGt8vPQwZx34QF3i00l/6nvNNJDCl2TN+3+3SDz1s4qq1C9MaJFWaCRpTIWGdYKnRaH a0XkSaJCnjRiuo1h0smItMOKS+Q5b/NB5PidDH5zZUXfTnVpaUKbdlJ571Icfclxudqd82 Un2v2saShSrFGoixU2DKp5wiT9+O+QuPPS5nhrO1aGHqgUvlUW8r6+kf1GrhKg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1774886537; a=rsa-sha256; cv=none; b=O4ysjVs+P3W/FtzD5LtFVoGWV3cFLR+hZZmZT8DhEoc1yU85proYWo6WsijY/kiCvhyzmJ EuAPRmmU3HU6CbaBEhpCCdnY2H4SS5+8HpIsQHAXdLT8xM671OFayGFxFzdd8MSSCPYEMZ 14VcbHnZCuKG2qz70rB26+clonZNuXnvIVNMEKTia9oEVQn1PQiu7t/43fM0PK2JFMJaca yS8cRDLnZ1thCS+3lhVmg0dTM8iTYb/RPsCPd3DNXnZBL4F3MWSBCdcf8zVXjBrXo11RVm YTXcGbwh3yRXtEVDao4Zc05NRdKNvtWOrY5DjcGb91dRCq0+93khLx4/aWRU2Q== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1774886537; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=g863N5nPu3sdp8yoWgaapcFfuXv8W4PyiaKyuRJXXto=; b=iPW5sCNsL62EzEO/WdlvDRpzHGwriCSRpwWLGKF3sOAKnmC+Bwnnto64BHzQE/0Lf30P7M yKWByERR50PxLI3r5NAPy4LamjjANCtQp4akmkqQGPWmkbtbytVvYEw6hwwiAhw7gmj++/ YYfUQ+sls5CE/Lzuuo4XBrIqt/oHE7HYwIxuBdALEvN+ZFtEyeEQyyCrtalFtb4T3MhkWy BtvHVyFLrrMyELx0VBlxjFnk8VKv9hiKa1fjOi0kGRCkuSYXhtjG+X68z6FHf5TnczNA/r 3rwD9PGsBP+HfdFSNw9LHpA6KdmFCqel7zxgoQiyJMHvU3WkkBZlpQEePDhuCA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4fkwxP57Y9zqRP for ; Mon, 30 Mar 2026 16:02:17 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 39858 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 30 Mar 2026 16:02:12 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Zhenlei Huang Subject: git: ee9456ce3753 - main - ifnet: Fix races in if_vmove_reclaim() List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: zlei X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: ee9456ce37539da5b651945eea18502f290eb133 Auto-Submitted: auto-generated Date: Mon, 30 Mar 2026 16:02:12 +0000 Message-Id: <69ca9e84.39858.1a21c3c1@gitrepo.freebsd.org> The branch main has been updated by zlei: URL: https://cgit.FreeBSD.org/src/commit/?id=ee9456ce37539da5b651945eea18502f290eb133 commit ee9456ce37539da5b651945eea18502f290eb133 Author: Zhenlei Huang AuthorDate: 2026-03-30 16:00:01 +0000 Commit: Zhenlei Huang CommitDate: 2026-03-30 16:00:01 +0000 ifnet: Fix races in if_vmove_reclaim() The thread running if_vmove_reclaim() may race with other threads those running if_detach(), if_vmove_loan() or if_vmove_reclaim(). In case the current thread loses race, two issues arise, 1. It is unstable and unsafe to access ifp->if_vnet, 2. The interface is removed from "active" list, hence if_unlink_ifnet() can fail. For the first case, check against source prison's vnet instead, given the interface is obtained from that vnet. For the second one, return ENODEV to indicate the interface was on the list but the current thread loses race, to distinguish from ENXIO, which means the interface or child prison is not found. This is the same with if_vmove_loan(). Reviewed by: kp, pouria Fixes: a779388f8bb3 if: Protect V_ifnet in vnet_if_return() MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D55997 --- sys/net/if.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/sys/net/if.c b/sys/net/if.c index 41084ecf0516..bdb5671c1afb 100644 --- a/sys/net/if.c +++ b/sys/net/if.c @@ -1242,7 +1242,7 @@ if_vmove_reclaim(struct thread *td, char *ifname, int jid) struct prison *pr; struct vnet *vnet_dst; struct ifnet *ifp; - int found __diagused; + int found; /* Try to find the prison within our visibility. */ sx_slock(&allprison_lock); @@ -1255,16 +1255,16 @@ if_vmove_reclaim(struct thread *td, char *ifname, int jid) /* Make sure the named iface exists in the source prison/vnet. */ CURVNET_SET(pr->pr_vnet); - ifp = ifunit(ifname); /* XXX Lock to avoid races. */ + ifp = ifunit(ifname); if (ifp == NULL) { CURVNET_RESTORE(); prison_free(pr); return (ENXIO); } - /* Do not try to move the iface from and to the same prison. */ + /* Do not try to move the iface from and to the same vnet. */ vnet_dst = TD_TO_VNET(td); - if (vnet_dst == ifp->if_vnet) { + if (vnet_dst == pr->pr_vnet) { CURVNET_RESTORE(); prison_free(pr); return (EEXIST); @@ -1272,7 +1272,11 @@ if_vmove_reclaim(struct thread *td, char *ifname, int jid) /* Get interface back from child jail/vnet. */ found = if_unlink_ifnet(ifp, true); - MPASS(found); + if (! found) { + CURVNET_RESTORE(); + prison_free(pr); + return (ENODEV); + } sx_xlock(&ifnet_detach_sxlock); if_vmove(ifp, vnet_dst); sx_xunlock(&ifnet_detach_sxlock);