Page MenuHomeFreeBSD

Fix panic during lagg destruction with simultaneous status check
ClosedPublic

Authored by asomers on Nov 14 2016, 7:01 PM.
Tags
None
Referenced Files
Unknown Object (File)
Sun, Dec 8, 8:22 AM
Unknown Object (File)
Wed, Dec 4, 1:25 AM
Unknown Object (File)
Nov 28 2024, 9:47 PM
Unknown Object (File)
Nov 23 2024, 1:23 PM
Unknown Object (File)
Oct 24 2024, 9:43 PM
Unknown Object (File)
Oct 1 2024, 7:24 AM
Unknown Object (File)
Sep 16 2024, 12:59 PM
Unknown Object (File)
Sep 15 2024, 12:36 AM
Subscribers

Details

Summary

Fix panic during lagg destruction with simultaneous status check

If you run "ifconfig lagg0 destroy" and "ifconfig lagg0" at the same time a
page fault may result. The first process will destroy ifp->if_lagg in
lagg_clone_destroy (called by if_clone_destroy). Then the second process
will observe that ifp->if_lagg is NULL at the top of lagg_port_ioctl and
goto fallback: where it will promptly dereference ifp->if_lagg anyway.

The solution is to repeat the NULL check for ifp->if_lagg

Test Plan

I have a kyua test script that repeately destroys a lagg while checking its
status. But I can't commit it yet because it panics too frequently.

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

asomers retitled this revision from to Fix panic during lagg destruction with simultaneous status check.
asomers updated this object.
asomers edited the test plan for this revision. (Show Details)
asomers added reviewers: rstone, melifaro.
This revision was automatically updated to reflect the committed changes.