Page MenuHomeFreeBSD

ng_eiface: fix kernel panic due to the racecondition in ng_eiface shutdown
ClosedPublic

Authored by afedorov on Apr 24 2020, 1:08 PM.

Diff Detail

Repository
rS FreeBSD src repository
Lint
Automatic diff as part of commit; lint not applicable.
Unit
Automatic diff as part of commit; unit tests not applicable.

Event Timeline

Looks good to me (with the suggested change). If I understand correctly, the crash happens when ng_eiface_mediastatus (which dereferences ifm->ifm_cur) is called after ifmedia_removeall (which sets ifm->ifm_cur = NULL, but before ether_ifdetach.

sys/netgraph/ng_eiface.c
628 ↗(On Diff #70940)

Move the ifmedia_removeall before if_free, because the ifmedia callbacks need to access ifp, and so in theory the callbacks may be called after if_free and before ifmedia_removeall, resulting in a crash (if lucky).
Moreover, ifdetach --> ifmedia_removeall --> if_free is the same sequence used in all the other drivers.

This revision now requires changes to proceed.Apr 24 2020, 8:32 PM
afedorov marked an inline comment as done.
This revision is now accepted and ready to land.Apr 25 2020, 12:14 PM