Page MenuHomeFreeBSD

Fix panic during lagg destruction with simultaneous status check
ClosedPublic

Authored by asomers on Nov 14 2016, 7:01 PM.
Tags
None
Referenced Files
Unknown Object (File)
Feb 24 2024, 1:34 AM
Unknown Object (File)
Jan 22 2024, 1:24 PM
Unknown Object (File)
Jan 20 2024, 12:18 AM
Unknown Object (File)
Dec 25 2023, 10:54 AM
Unknown Object (File)
Dec 22 2023, 8:13 AM
Unknown Object (File)
Dec 20 2023, 2:38 AM
Unknown Object (File)
Dec 16 2023, 2:35 PM
Unknown Object (File)
Dec 16 2023, 2:34 PM
Subscribers

Details

Summary

Fix panic during lagg destruction with simultaneous status check

If you run "ifconfig lagg0 destroy" and "ifconfig lagg0" at the same time a
page fault may result. The first process will destroy ifp->if_lagg in
lagg_clone_destroy (called by if_clone_destroy). Then the second process
will observe that ifp->if_lagg is NULL at the top of lagg_port_ioctl and
goto fallback: where it will promptly dereference ifp->if_lagg anyway.

The solution is to repeat the NULL check for ifp->if_lagg

Test Plan

I have a kyua test script that repeately destroys a lagg while checking its
status. But I can't commit it yet because it panics too frequently.

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

asomers retitled this revision from to Fix panic during lagg destruction with simultaneous status check.
asomers updated this object.
asomers edited the test plan for this revision. (Show Details)
asomers added reviewers: rstone, melifaro.
This revision was automatically updated to reflect the committed changes.