git: 9f5432d5e5f0 - main - netinet6: ip6_setpktopt() requires NET_EPOCH

From: Kristof Provost <kp_at_FreeBSD.org>
Date: Fri, 17 Dec 2021 17:00:00 UTC
The branch main has been updated by kp:

URL: https://cgit.FreeBSD.org/src/commit/?id=9f5432d5e5f0ef9e034ad3da9fe6b1cf876ae68f

commit 9f5432d5e5f0ef9e034ad3da9fe6b1cf876ae68f
Author:     Kristof Provost <kp@FreeBSD.org>
AuthorDate: 2021-12-15 13:53:41 +0000
Commit:     Kristof Provost <kp@FreeBSD.org>
CommitDate: 2021-12-17 16:30:36 +0000

    netinet6: ip6_setpktopt() requires NET_EPOCH
    
    ip6_setpktopt() can call ifnet_byindex() which requires epoch. Mark the
    function as requiring NET_EPOCH, and ensure we enter it priot to calling
    it.
    
    Reported-by: syzbot+92526116441688fea8a3@syzkaller.appspotmail.com
    Reviewed by:    glebius
    Sponsored by:   Rubicon Communications, LLC ("Netgate")
    Differential Revision:  https://reviews.freebsd.org/D33462
---
 sys/netinet6/ip6_output.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/sys/netinet6/ip6_output.c b/sys/netinet6/ip6_output.c
index 7d8793b691b4..848ec6694398 100644
--- a/sys/netinet6/ip6_output.c
+++ b/sys/netinet6/ip6_output.c
@@ -2546,7 +2546,9 @@ static int
 ip6_pcbopt(int optname, u_char *buf, int len, struct ip6_pktopts **pktopt,
     struct ucred *cred, int uproto)
 {
+	struct epoch_tracker et;
 	struct ip6_pktopts *opt;
+	int ret;
 
 	if (*pktopt == NULL) {
 		*pktopt = malloc(sizeof(struct ip6_pktopts), M_IP6OPT,
@@ -2557,7 +2559,11 @@ ip6_pcbopt(int optname, u_char *buf, int len, struct ip6_pktopts **pktopt,
 	}
 	opt = *pktopt;
 
-	return (ip6_setpktopt(optname, buf, len, opt, cred, 1, 0, uproto));
+	NET_EPOCH_ENTER(et);
+	ret = ip6_setpktopt(optname, buf, len, opt, cred, 1, 0, uproto);
+	NET_EPOCH_EXIT(et);
+
+	return (ret);
 }
 
 #define GET_PKTOPT_VAR(field, lenexpr) do {					\
@@ -2886,6 +2892,8 @@ ip6_setpktopt(int optname, u_char *buf, int len, struct ip6_pktopts *opt,
 	int minmtupolicy, preftemp;
 	int error;
 
+	NET_EPOCH_ASSERT();
+
 	if (!sticky && !cmsg) {
 #ifdef DIAGNOSTIC
 		printf("ip6_setpktopt: impossible case\n");