From nobody Thu May 05 19:14:53 2022 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 9974E1ACA68F; Thu, 5 May 2022 19:14:54 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4KvNgL330Mz4my6; Thu, 5 May 2022 19:14:54 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1651778094; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=moeJQwVeKmET22dK0ww6uKzahR+uxtkbrY+CVjQuM+o=; b=eFXR1fYFpzicI++m0W2MTrkHKFVdOPXkXr58Uc02S3dzXp/JJfygLEyu8l9niOtV1azU4w XBRmJrIMfc6fg86KP+D7I0W15PpJ5arBqnvYknGMsXylDyw4TQANM0biYQKgvAxSNj+dzw vB4RFleQEU2T/7tVrSbF2Rn8j2Jm3o10Tl2txNRnHhYbDBEem3xMkH2A0p8ZvKa/jldYmh AjtbhZ9M2IFcQopZwez3rYEN/Vqw1LtyNlWCyNEXLSod5a9wx+uH1F463XgJk72NYJywv4 10FGlR4Clfp+oLBFqWjGHChWD8JhkLqq1US/FdvAriMKnnhJCKJnnUG7IL5Vzw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 1BF2E566E; Thu, 5 May 2022 19:14:54 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 245JEsQh090347; Thu, 5 May 2022 19:14:54 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 245JErGX090346; Thu, 5 May 2022 19:14:53 GMT (envelope-from git) Date: Thu, 5 May 2022 19:14:53 GMT Message-Id: <202205051914.245JErGX090346@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Ed Maste Subject: git: 613acc64834b - main - mbuf: do not restore dying interfaces List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-main@freebsd.org X-BeenThere: dev-commits-src-main@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: emaste X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 613acc64834b17dd30527b488198b1a9139911c1 Auto-Submitted: auto-generated ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1651778094; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=moeJQwVeKmET22dK0ww6uKzahR+uxtkbrY+CVjQuM+o=; b=e7bnOecWYo7DvftEhMbLRX6r/0EQwub16A3px3PXIhh5ehDfVyD2640kIPfYNv+dGts8N1 Zv1PmBkAbHEBjxW5RPJUxj8ql3wBaRv1g4HEE0guifq/WjjgauxG6oP+6+bQ0v6Fn2qPLh kdYRFH8tTPnT+iaSkj1RtSDZCW2dnffTk0/M467Dsmy4z9W5YtVowOSkwgJZx4/truV8TN gqs3YHcc9L9y/d2KrmYNuQhoACpkJgV8TZ3Ei+6x/BGes+Fy6V+ne9WHHnHizlD+sPps5k C9i0Bd90oSURKJy4RncishWdabMk9xb1hirjGkWykfZzbaO3RwaCZdOvU6DQdw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1651778094; a=rsa-sha256; cv=none; b=Bwf6OLSxq26hEdN/GSSBneV9Q3IgrYG/W+D8+2wWbAn6eatKh8cKgsBFqqog2CfpG60j1u oZT90RKjH5B0OpcbGIPBYHe2jkMDm3+sRgGgZOH03At+tM+MZsfPwvu42j48rE/3aM3oWg fujhaxwyC1kNohxyI+I5qV0jPCMvlvXgi8Z++cqxLaf4WXa90yqbCFOmKuM22Pf7jYbzyH NYxdGUatO+gyfmWzaNT0x19UzI0ghZV1skV4kxF2UzskHIq6qgrh5o6u2OAM4CNhRy/y3H IwS1IDERi5MaaVyyZqIZeZktyVK+NzwYZk4iibcBFQr5PSjhxqcY3kEAq4DYAQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N The branch main has been updated by emaste: URL: https://cgit.FreeBSD.org/src/commit/?id=613acc64834b17dd30527b488198b1a9139911c1 commit 613acc64834b17dd30527b488198b1a9139911c1 Author: Kristof Provost AuthorDate: 2022-01-27 21:01:09 +0000 Commit: Ed Maste CommitDate: 2022-05-05 18:38:08 +0000 mbuf: do not restore dying interfaces When we remove an interface it is first removed from the interface list V_ifnet (by if_unlink_ifnet()) and marked as IFF_DYING. We then wait for any possible references to stop being used (i.e. epoch_wait/epoch_drain_callbacks) before we tear it fully down. However, the index in ifindex_table is not removed, so m_rcvif_restore() can still find the (now dying) interface. This results in panics, for example when dummynet restores the rcvif pointer and passes a packet to ip6_input() we can panic because the AF_INET6 domain has already been removed (so we end up dereferencing a NULL pointer there). Check that the interface is not dying before we restore it, which is equivalent to checking its presence in V_ifnet, and thus ensures that future accesses (while in NET_EPOCH) are safe. Reviewed by: glebius Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D34076 (cherry picked from commit 703e533da5e2e4743d38bbf4605fec041bc69976) --- sys/kern/kern_mbuf.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/sys/kern/kern_mbuf.c b/sys/kern/kern_mbuf.c index 5c69f663c0e2..23050e991418 100644 --- a/sys/kern/kern_mbuf.c +++ b/sys/kern/kern_mbuf.c @@ -1650,11 +1650,16 @@ m_rcvif_serialize(struct mbuf *m) struct ifnet * m_rcvif_restore(struct mbuf *m) { + struct ifnet *ifp; M_ASSERTPKTHDR(m); + NET_EPOCH_ASSERT(); + + ifp = ifnet_byindexgen(m->m_pkthdr.rcvidx, m->m_pkthdr.rcvgen); + if (ifp == NULL || (ifp->if_flags & IFF_DYING)) + return (NULL); - return ((m->m_pkthdr.rcvif = ifnet_byindexgen(m->m_pkthdr.rcvidx, - m->m_pkthdr.rcvgen))); + return (m->m_pkthdr.rcvif = ifp); } /*