svn commit: r349507 - head/sys/net

[Hans Petter Selasky]

Author: hselasky
Date: Fri Jun 28 10:49:04 2019
New Revision: 349507
URL: https://svnweb.freebsd.org/changeset/base/349507

Log:
  Need to wait for epoch callbacks to complete before detaching a
  network interface.
  
  This particularly manifests itself when an INP has multicast options
  attached during a network interface detach. Then the IPv4 and IPv6
  leave group call which results from freeing the multicast address, may
  access a freed ifnet structure. These are the steps to reproduce:
  
  service mdnsd onestart # installed from ports
  
  ifconfig epair create
  ifconfig epair0a 0/24 up
  ifconfig epair0a destroy
  
  Tested by:	pho @
  MFC after:	1 week
  Sponsored by:	Mellanox Technologies

Modified:
  head/sys/net/if.c

Modified: head/sys/net/if.c
==============================================================================
--- head/sys/net/if.c	Fri Jun 28 10:38:56 2019	(r349506)
+++ head/sys/net/if.c	Fri Jun 28 10:49:04 2019	(r349507)
@@ -1127,6 +1127,15 @@ if_detach_internal(struct ifnet *ifp, int vmove, struc
 	curvnet->vnet_ifcnt--;
 #endif
 	epoch_wait_preempt(net_epoch_preempt);
+
+	/*
+	 * Ensure all pending EPOCH(9) callbacks have been executed. This
+	 * fixes issues about late destruction of multicast options
+	 * which lead to leave group calls, which in turn access the
+	 * belonging ifnet structure:
+	 */
+	epoch_drain_callbacks(net_epoch_preempt);
+
 	/*
 	 * In any case (destroy or vmove) detach us from the groups
 	 * and remove/wait for pending events on the taskq.