Page MenuHomeFreeBSD

bpf: Fix potential race conditions
ClosedPublic

Authored by zlei on Jun 25 2024, 7:47 AM.
Tags
None
Referenced Files
Unknown Object (File)
Mon, Feb 24, 12:05 AM
Unknown Object (File)
Sun, Feb 23, 2:59 PM
Unknown Object (File)
Sun, Feb 23, 2:49 PM
Unknown Object (File)
Sun, Feb 23, 2:04 PM
Unknown Object (File)
Sun, Feb 23, 9:20 AM
Unknown Object (File)
Thu, Feb 13, 4:13 PM
Unknown Object (File)
Wed, Feb 12, 6:56 AM
Unknown Object (File)
Feb 3 2025, 12:17 PM

Details

Summary

The global lock (BPF_LOCK) does not (and should not) guarantee the
liveness of ifp, so it is potential that bpf_setif() would reference
dead_bpf_if or freed bpf_if.

As the progress of attach is not atomic, there is also a small window
that userland could have inconsistant view of available data link types
of the interface (via BIOCGDLTLIST ioctl).

Fix them by checking our side, aka bpf_iflist, rather than the interface's
side to ensure that the requested interface is attached to bpf.

This have side effect of reverting a bpf interface attach operation
(BIOCSETIF ioctl) from O(1) to O(N) (where N is the number of bpf
interfaces). Well since normally we have sane amount of interfaces and
the attach operation is not frequent, this O(N) is affordable.

Fixes: 16d878cc99ef Fix the following bpf(4) race condition ...
MFC after: 1 week

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable