[Bug 274873] A possible data race in sys/netpfil/ipfw/dn_aqm_pie.c

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=274873

            Bug ID: 274873
           Summary: A possible data race in sys/netpfil/ipfw/dn_aqm_pie.c
           Product: Base System
           Version: 14.0-RELEASE
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: kern
          Assignee: bugs@FreeBSD.org
          Reporter: islituo@gmail.com

The struct field pst->measurement_start is initialized by init_activate_pie().
And in this function pst->measurement_start is set to AQM_UNOW after
pst->sflags is set:

  pst->sflags = PIE_INMEASUREMENT;
  pst->measurement_start = AQM_UNOW;

However, if aqm_pie_dequeue() is called right after pst->sflags is set to
PIE_INMEASUREMENT, a data race can occur:

  dq_time = now - pst->measurement_start;

because pst->measurement_start is accessed without holding the lock
pst->lock_mtx.

The value of dq_time may be invalid in this condition.

-- 
You are receiving this mail because:
You are the assignee for the bug.