From nobody Sun Jul 14 16:43:18 2024 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4WMWNk6M6kz5QyV5; Sun, 14 Jul 2024 16:43:18 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4WMWNk5gtjz4MHV; Sun, 14 Jul 2024 16:43:18 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1720975398; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=W1b3JRMyCz+so9HZW0AzRTUr1mVGbgLsbhFCD65lfHM=; b=VCn9KmDPu2GOtTE/ehi4CBYU2oFUXIlAFI9MmT+S5uoC4hogM6zfY2cDK+UJt0RA13sGyD rnLbDb2OEqY6sAADZN56hPoYB6HJYBnmazUAMhyBIQJyA+ELowGCkL0kxNgN4AxI1VAdDZ R6GSpHmJnUZxCRNFH1kvYQ+/Unjh2BclApi3RrdZtR6Ik9z1VGAE5oT/eqMh45K7eSIfSd aW2SVfWBKDcpFq3wf5tdqSSay/GWBzfe/R1XixU8yZlHettjRgAQS20cgmaepEuxxBT0eY bWvHhEAJUm9b7x/pMviiHR20TRfiGVId7rexSbx9i+taYrHd24NycFBtcIL+Xg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1720975398; a=rsa-sha256; cv=none; b=u4w3Tg9j6fRNC5lc7X3TzIZbJOIvL6Gvu5OCR7NYXyrskX8P7vb43/w05t2BKXzcX59sWD qPRfMjyUb0K5q2i5O6Gvkoq4sXr3/bRXg7Y6BNttfNg+YQqxVeOVtmaKSQjGXUdTse/YvA nQ8v5nlO9ivgrSdA4FNA3PEubwcsQ4/WH0Ct1PglNmjMV10dcYd4Yqqbx9hRgYP+qPRboA wyVEWCQ1ohpgERqj5ExnFu6Y0ZU93K68xlJCEktkTCXucC9G7d2CSvp/tMFcz07Gaxf49M CUOqdYUiywuKjp2mrZVnaNYWj8cT2UUdaIm3mU2i/apZNQiPZTrfGc0IephZUA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1720975398; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=W1b3JRMyCz+so9HZW0AzRTUr1mVGbgLsbhFCD65lfHM=; b=HFZgPOAvWpnuNFBjnXX9c39BoP/V15C/qC8D88/nzb7BvLWhq4KATmG+85jmn92VXemF3L qVNeGBPXi/8fIrERXvnYoSZB03bM8tyfCGYqYCUszRZ9I/V46A9x0Facy2owF1H1yhI9hV z/tGOHU/1K4Kznpl6jXtzSrpQIANVaXpxaSb+LM114avNvMTAQqEZ3Rgxn+CDrrWdd1odg N2qq1oKhYIavbnZe94tqSisx1rUQe2WyUi4TBx0mC7P892AkSvoHjQbDYVQk8f3Ewm1NG5 yiMeRo/RRkL62LBSo5nu0d1Zg/C7E+bRtRA1mmgb9cS+gMFSoHTd73+iaSrKaQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4WMWNk5GfCzHX7; Sun, 14 Jul 2024 16:43:18 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 46EGhIKV039567; Sun, 14 Jul 2024 16:43:18 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 46EGhINI039563; Sun, 14 Jul 2024 16:43:18 GMT (envelope-from git) Date: Sun, 14 Jul 2024 16:43:18 GMT Message-Id: <202407141643.46EGhINI039563@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 7126da66e484 - stable/14 - lagg: Fix a teardown race List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: 7126da66e4848e89ac29fd7b9da9e6fdb3b52f17 Auto-Submitted: auto-generated The branch stable/14 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=7126da66e4848e89ac29fd7b9da9e6fdb3b52f17 commit 7126da66e4848e89ac29fd7b9da9e6fdb3b52f17 Author: Mark Johnston AuthorDate: 2024-06-24 14:47:29 +0000 Commit: Mark Johnston CommitDate: 2024-07-14 16:16:01 +0000 lagg: Fix a teardown race When a lagg interface is destroyed, it destroys all of the lagg ports, which triggers an asynchronous link state change handler. This in turn may generate a netlink message, a portion of which requires netlink to invoke the SIOCGIFMEDIA ioctl of the lagg interface, which involves scanning the list of interface media. This list is not internally locked, it requires the interface driver to provide some kind of synchronization. Shortly after the link state notification has been raised, the lagg interface detaches itself from the network stack. As a part of this, it blocks in order to wait for link state handlers to drain, but before that it destroys the interface media list. Reverse this order of operations so that the link state change handlers drain first, avoiding a use-after-free that is very occasionally triggered by lagg stress tests. This matches other ethernet drivers in the tree. MFC after: 2 weeks (cherry picked from commit 02cbf9ebf110c94ec9e60f0801716ff0a75e55e5) --- sys/net/if_lagg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/net/if_lagg.c b/sys/net/if_lagg.c index e55b46a047df..baf2643ff871 100644 --- a/sys/net/if_lagg.c +++ b/sys/net/if_lagg.c @@ -636,8 +636,8 @@ lagg_clone_destroy(struct if_clone *ifc, struct ifnet *ifp, uint32_t flags) switch (ifp->if_type) { case IFT_ETHER: - ifmedia_removeall(&sc->sc_media); ether_ifdetach(ifp); + ifmedia_removeall(&sc->sc_media); break; case IFT_INFINIBAND: infiniband_ifdetach(ifp);