svn commit: r349765 - stable/12/sys/net

[Hans Petter Selasky]

Author: hselasky
Date: Fri Jul  5 12:35:49 2019
New Revision: 349765
URL: https://svnweb.freebsd.org/changeset/base/349765

Log:
  MFC r349507:
  Need to wait for epoch callbacks to complete before detaching a
  network interface.
  
  This particularly manifests itself when an INP has multicast options
  attached during a network interface detach. Then the IPv4 and IPv6
  leave group call which results from freeing the multicast address, may
  access a freed ifnet structure. These are the steps to reproduce:
  
  service mdnsd onestart # installed from ports
  
  ifconfig epair create
  ifconfig epair0a 0/24 up
  ifconfig epair0a destroy
  
  Tested by:	pho @
  Sponsored by:	Mellanox Technologies

Modified:
  stable/12/sys/net/if.c
Directory Properties:
  stable/12/   (props changed)

Modified: stable/12/sys/net/if.c
==============================================================================
--- stable/12/sys/net/if.c	Fri Jul  5 12:33:31 2019	(r349764)
+++ stable/12/sys/net/if.c	Fri Jul  5 12:35:49 2019	(r349765)
@@ -1100,6 +1100,15 @@ if_detach_internal(struct ifnet *ifp, int vmove, struc
 	curvnet->vnet_ifcnt--;
 #endif
 	epoch_wait_preempt(net_epoch_preempt);
+
+	/*
+	 * Ensure all pending EPOCH(9) callbacks have been executed. This
+	 * fixes issues about late destruction of multicast options
+	 * which lead to leave group calls, which in turn access the
+	 * belonging ifnet structure:
+	 */
+	epoch_drain_callbacks(net_epoch_preempt);
+
 	/*
 	 * In any case (destroy or vmove) detach us from the groups
 	 * and remove/wait for pending events on the taskq.