Page MenuHomeFreeBSD

Use pointer to fake bpf_if structure after bpfdetach()
ClosedPublic

Authored by ae on Apr 16 2018, 10:49 AM.
Tags
None
Referenced Files
Unknown Object (File)
Jan 10 2024, 1:49 AM
Unknown Object (File)
Nov 13 2023, 8:01 AM
Unknown Object (File)
Nov 11 2023, 8:02 AM
Unknown Object (File)
Oct 9 2023, 7:00 AM
Unknown Object (File)
Oct 7 2023, 7:01 AM
Unknown Object (File)
Sep 7 2023, 5:08 AM
Unknown Object (File)
Sep 7 2023, 5:07 AM
Unknown Object (File)
Sep 7 2023, 5:07 AM
Subscribers

Details

Summary
Add dead_bpf_if structure, that should be used as fake bpf_if
during ifnet detach.

Since destroying interface is not atomic operation and due to the
lack of synhronization during destroy, it is possible, that in the
time between bpfdetach() and if_free() some queued on destroying
interface mbuf will be used by ether_input_internal() and bpf_peers_present()
can dereference NULL bpf_if pointer. To protect from this, assign
pointer to empty bpf_if_ext structure instead of NULL pointer after
bpfdetach().

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

This revision is now accepted and ready to land.Apr 16 2018, 11:05 AM
melifaro added inline comments.
sys/net/bpf.c
102 ↗(On Diff #41503)

Why do we explicitly zero bif_next?

This revision was automatically updated to reflect the committed changes.