Page MenuHomeFreeBSD

ng_eiface: fix kernel panic due to the racecondition in ng_eiface shutdown
ClosedPublic

Authored by afedorov on Apr 24 2020, 1:08 PM.
Tags
None
Referenced Files
Unknown Object (File)
Thu, Mar 14, 9:20 AM
Unknown Object (File)
Jan 18 2024, 12:02 PM
Unknown Object (File)
Dec 31 2023, 8:12 PM
Unknown Object (File)
Dec 20 2023, 7:06 AM
Unknown Object (File)
Nov 23 2023, 4:53 PM
Unknown Object (File)
Oct 13 2023, 1:41 PM
Unknown Object (File)
Sep 10 2023, 10:52 AM
Unknown Object (File)
Jul 30 2023, 7:41 AM

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

Looks good to me (with the suggested change). If I understand correctly, the crash happens when ng_eiface_mediastatus (which dereferences ifm->ifm_cur) is called after ifmedia_removeall (which sets ifm->ifm_cur = NULL, but before ether_ifdetach.

sys/netgraph/ng_eiface.c
628 ↗(On Diff #70940)

Move the ifmedia_removeall before if_free, because the ifmedia callbacks need to access ifp, and so in theory the callbacks may be called after if_free and before ifmedia_removeall, resulting in a crash (if lucky).
Moreover, ifdetach --> ifmedia_removeall --> if_free is the same sequence used in all the other drivers.

This revision now requires changes to proceed.Apr 24 2020, 8:32 PM
afedorov marked an inline comment as done.
This revision is now accepted and ready to land.Apr 25 2020, 12:14 PM