HomeFreeBSD

ifnet: Fix races in if_vmove_reclaim()

Description

ifnet: Fix races in if_vmove_reclaim()

The thread running if_vmove_reclaim() may race with other threads those
running if_detach(), if_vmove_loan() or if_vmove_reclaim(). In case the
current thread loses race, two issues arise,

  1. It is unstable and unsafe to access ifp->if_vnet,
  2. The interface is removed from "active" list, hence if_unlink_ifnet() can fail.

For the first case, check against source prison's vnet instead, given
the interface is obtained from that vnet.

For the second one, return ENODEV to indicate the interface was on the
list but the current thread loses race, to distinguish from ENXIO, which
means the interface or child prison is not found. This is the same with
if_vmove_loan().

Reviewed by: kp, pouria
Fixes: a779388f8bb3 if: Protect V_ifnet in vnet_if_return()
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D55997

Details

Provenance
zleiAuthored on Mar 30 2026, 4:00 PM
Reviewer
rGa779388f8bb3: if: Protect V_ifnet in vnet_if_return()
Differential Revision
D55997: ifnet: Fix races in if_vmove_reclaim()
Parents
rG0f147784de10: stat(2): Send to sticky(7) in the S_ISVTX description
Branches
Unknown
Tags
Unknown