HomeFreeBSD

mbuf: do not restore dying interfaces

Description

mbuf: do not restore dying interfaces

When we remove an interface it is first removed from the interface list
V_ifnet (by if_unlink_ifnet()) and marked as IFF_DYING. We then wait for
any possible references to stop being used (i.e.
epoch_wait/epoch_drain_callbacks) before we tear it fully down.

However, the index in ifindex_table is not removed, so m_rcvif_restore()
can still find the (now dying) interface.

This results in panics, for example when dummynet restores the rcvif
pointer and passes a packet to ip6_input() we can panic because the
AF_INET6 domain has already been removed (so we end up dereferencing a
NULL pointer there).

Check that the interface is not dying before we restore it, which is
equivalent to checking its presence in V_ifnet, and thus ensures that
future accesses (while in NET_EPOCH) are safe.

Reviewed by: glebius
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D34076

(cherry picked from commit 703e533da5e2e4743d38bbf4605fec041bc69976)

Details

Provenance
kpAuthored on Jan 27 2022, 9:01 PM
emasteCommitted on May 5 2022, 6:38 PM
Reviewer
glebius
Differential Revision
D34076: mbuf: do not restore dying interfaces
Parents
rG51f798e761b1: netisr: serialize/restore m_pkthdr.rcvif when queueing mbufs
Branches
Unknown
Tags
Unknown