Date: Mon, 27 Sep 2021 19:32:08 UTC
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=258751 Bug ID: 258751 Summary: race between pfi_kkif_update() and if_addgroup() Product: Base System Version: CURRENT Hardware: Any OS: Any Status: New Severity: Affects Only Me Priority: --- Component: kern Assignee: bugs@FreeBSD.org Reporter: markj@FreeBSD.org We have the following syzbot report: https://syzkaller.appspot.com/bug?id=6698f3333928ca407039fd0bbe9238983681936f The crash happened right after the fuzzer started, at a point where it would have been creating a number of tun interfaces for packet injection. I suspect the following race is possible: - Thread 1 creates a tun interface, which is automatically added to an interface group. if_addgroup() creates the new interface group and adds the new interface to it. Then it drops locks before generating the group_attach_event event, and is preempted. - Thread 2 creates a second tun interface. The group is already created so the group_attach_event event handlers do not run. - Thread 2 assigns an interface address. This runs ifaddr_event event handlers, including pfi_ifaddr_event(), which calls pfi_kkif_update(). pfi_kkif_update() recurses and is called on the new interface's containing groups, including the one that thread 1 is still constructing. - Thread 2 panics: thread 1 has created the group but the ifg_pf_kif field is uninitialized. We could modify if_addgroup() to initialize the ifg_pf_kif field to NULL, and modify pfi_kkif_update() to handle a NULL ifg_pf_kif, but I'm not sure that this is correct. -- You are receiving this mail because: You are the assignee for the bug.