[Bug 289017] [lagg] A time-of-check to time-of-use (TOCTOU) race exists in the Link Aggregation (LAGG) network subsystem

Go to: [ bottom of page ] [ top of archives ] [ this month ]

From: <bugzilla-noreply_at_freebsd.org>
Date: Mon, 15 Dec 2025 02:58:34 UTC

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=289017

--- Comment #10 from Gui-Dong Han <hanguidong02@gmail.com> ---
(In reply to Gui-Dong Han from comment #7)

Given that the transmit path can continue into the protocol's start function
after lagg_proto_detach has executed (as evidenced by the crash above), and
considering that detach explicitly frees protocol resources, I believe
triggering a Use-After-Free (UAF) scenario is also highly probable with the
specific timing.

-- 
You are receiving this mail because:
You are the assignee for the bug.