[Bug 258751] race between pfi_kkif_update() and if_addgroup()

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=258751

            Bug ID: 258751
           Summary: race between pfi_kkif_update() and if_addgroup()
           Product: Base System
           Version: CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: kern
          Assignee: bugs@FreeBSD.org
          Reporter: markj@FreeBSD.org

We have the following syzbot report:
https://syzkaller.appspot.com/bug?id=6698f3333928ca407039fd0bbe9238983681936f

The crash happened right after the fuzzer started, at a point where it would
have been creating a number of tun interfaces for packet injection.  I suspect
the following race is possible:

- Thread 1 creates a tun interface, which is automatically added to an
interface group.  if_addgroup() creates the new interface group and adds the
new interface to it.  Then it drops locks before generating the
group_attach_event event, and is preempted.
- Thread 2 creates a second tun interface.  The group is already created so the
group_attach_event event handlers do not run.
- Thread 2 assigns an interface address.  This runs ifaddr_event event
handlers, including pfi_ifaddr_event(), which calls pfi_kkif_update(). 
pfi_kkif_update() recurses and is called on the new interface's containing
groups, including the one that thread 1 is still constructing.
- Thread 2 panics: thread 1 has created the group but the ifg_pf_kif field is
uninitialized.

We could modify if_addgroup() to initialize the ifg_pf_kif field to NULL, and
modify pfi_kkif_update() to handle a NULL ifg_pf_kif, but I'm not sure that
this is correct.

-- 
You are receiving this mail because:
You are the assignee for the bug.