From nobody Mon Jun 1 18:30:14 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gTjF24Nvkz6gVC1 for ; Mon, 01 Jun 2026 18:30:14 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R13" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gTjF21DRpz3CHx for ; Mon, 01 Jun 2026 18:30:14 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1780338614; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=GK9lK5ciA6vKZRx99k6LJueirF3RZnxv4iolkFMjNUA=; b=g/NJpEzVgm8SkUc4Jf7lD3Y7VpvU4+Oz6ecS4qVKNBabktqAraWN5OaIjZpe0ty9/oNfvE uxmm0WoY3U01L9XLwozFJx5VHSJduKaMnTa/eQNjUiQfwlNztzYz7X+lmeR+BLQoNqS/ZM 7r4Xozu4sYlmfkNpMFdrC9AbtZt/02CZcK4UAOmut0YdzVJqQcObo16F01ukBtpvyXSqOz NP/tPSaR2VcbU0EDeNNVZTAvwYgXwIBcwW/FfqGpFeI8RUADeQAQvdJSILB5iiqxE2zfyV s/NEmJ9fConReZ81LMoZiTLD4Y3Z4rgBX0BgBAp1J88tcxWRfq+HWiOqJJM8Sw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1780338614; a=rsa-sha256; cv=none; b=ZkZO7w2tGmNxeOObne73gDesx+hdvE5ixRJ0imMLqfqN8aILwgIL0Whkolh7zJ4ZHVIp5a mpbBBYv+GAvcMs9NA4bD0U9mHpqcSvd/0BcHRnTzATFn8469cbjVfrNUb0WQ6XUeNx+n+s o1Osz4jH1z3XY9+HEd/CJo/pEyj91c0sW31v4UsxnPiHsr8xKRk9KiS6Ml26Rxbk2YfySN Qd2/fO+Fz9vey9vWVTySFT/ItZiKe6Jp4s+RkWQREa5OzaQky0OHg2UPNqRT2h5SKFgbqD 315k1cFziMAN258kB2p39rbwTJlgXADYo2elQmNCvo9SCQpCxoF6MRFisgDqDw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1780338614; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=GK9lK5ciA6vKZRx99k6LJueirF3RZnxv4iolkFMjNUA=; b=M56hJZg2foiJ95ZHFe+igdhs0NILaJ751FAb2kRsFVdazrbq28iOM6HJiYtOHA0guMg1T+ qNeEaA+RaUTjOlzoh6QkLm9/Z1vHhA7R5XW14hyzXJc2S4NO9aijFnquYIctku+SPwKUdx P1Xh6H/F9hitrxFbr8qXJLhW2P5ZxmE04Mki6HFJKVnlLluYJNXHqJzyV43zG6n2r8+EuK pagh8Vk9LepNwZxV6K4EPSQI0F6kKKU98Pj3//XehWUikMCCOdjUhRDVlImEC1/k1heZIt B99Mde17TQ2szXGpYRAk6JkKbo8UAlPTYmkMtUAkjrBdbmMRB3ubM2AWAahyBQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gTjF20plczqVW for ; Mon, 01 Jun 2026 18:30:14 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 21b07 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 01 Jun 2026 18:30:14 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Mark Johnston Subject: git: 68004e56fdc2 - main - net: Fix handling of unmapped user pages in if_getgroup() List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 68004e56fdc22c11b4ec680e83309b4ea2bfe13a Auto-Submitted: auto-generated Date: Mon, 01 Jun 2026 18:30:14 +0000 Message-Id: <6a1dcfb6.21b07.2d08d54a@gitrepo.freebsd.org> The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=68004e56fdc22c11b4ec680e83309b4ea2bfe13a commit 68004e56fdc22c11b4ec680e83309b4ea2bfe13a Author: Mark Johnston AuthorDate: 2026-06-01 16:44:15 +0000 Commit: Mark Johnston CommitDate: 2026-06-01 18:22:57 +0000 net: Fix handling of unmapped user pages in if_getgroup() We cannot call copyout() while in a net epoch section, unless the user memory is wired. Use the global ifnet lock to synchronize the accesses instead. Reported by: emaste Reviewed by: zlei MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D57154 --- sys/net/if.c | 56 +++++++++++++++++++++------------------------------- sys/net/if_private.h | 2 +- 2 files changed, 24 insertions(+), 34 deletions(-) diff --git a/sys/net/if.c b/sys/net/if.c index e421dd3bd494..440b40102d53 100644 --- a/sys/net/if.c +++ b/sys/net/if.c @@ -1375,11 +1375,8 @@ if_addgroup(struct ifnet *ifp, const char *groupname) ifgl->ifgl_group = ifg; ifgm->ifgm_ifp = ifp; - IF_ADDR_WLOCK(ifp); CK_STAILQ_INSERT_TAIL(&ifg->ifg_members, ifgm, ifgm_next); CK_STAILQ_INSERT_TAIL(&ifp->if_groups, ifgl, ifgl_next); - IF_ADDR_WUNLOCK(ifp); - IFNET_WUNLOCK(); if (new) @@ -1402,9 +1399,7 @@ _if_delgroup_locked(struct ifnet *ifp, struct ifg_list *ifgl, IFNET_WLOCK_ASSERT(); - IF_ADDR_WLOCK(ifp); CK_STAILQ_REMOVE(&ifp->if_groups, ifgl, ifg_list, ifgl_next); - IF_ADDR_WUNLOCK(ifp); CK_STAILQ_FOREACH(ifgm, &ifgl->ifgl_group->ifg_members, ifgm_next) { if (ifgm->ifgm_ifp == ifp) { @@ -1479,34 +1474,35 @@ if_delgroups(struct ifnet *ifp) static int if_getgroup(struct ifgroupreq *ifgr, struct ifnet *ifp) { - int len, error; - struct ifg_list *ifgl; - struct ifg_req ifgrq, *ifgp; - - NET_EPOCH_ASSERT(); + struct ifg_list *ifgl; + struct ifg_req ifgrq, *ifgp; + int len, error; + IFNET_RLOCK(); if (ifgr->ifgr_len == 0) { CK_STAILQ_FOREACH(ifgl, &ifp->if_groups, ifgl_next) ifgr->ifgr_len += sizeof(struct ifg_req); - return (0); - } - - len = ifgr->ifgr_len; - ifgp = ifgr->ifgr_groups; - /* XXX: wire */ - CK_STAILQ_FOREACH(ifgl, &ifp->if_groups, ifgl_next) { - if (len < sizeof(ifgrq)) - return (EINVAL); - bzero(&ifgrq, sizeof ifgrq); - strlcpy(ifgrq.ifgrq_group, ifgl->ifgl_group->ifg_group, - sizeof(ifgrq.ifgrq_group)); - if ((error = copyout(&ifgrq, ifgp, sizeof(struct ifg_req)))) - return (error); - len -= sizeof(ifgrq); - ifgp++; + error = 0; + } else { + len = ifgr->ifgr_len; + ifgp = ifgr->ifgr_groups; + CK_STAILQ_FOREACH(ifgl, &ifp->if_groups, ifgl_next) { + if (len < sizeof(ifgrq)) { + error = EINVAL; + break; + } + bzero(&ifgrq, sizeof ifgrq); + strlcpy(ifgrq.ifgrq_group, ifgl->ifgl_group->ifg_group, + sizeof(ifgrq.ifgrq_group)); + if ((error = copyout(&ifgrq, ifgp, sizeof(struct ifg_req)))) + break; + len -= sizeof(ifgrq); + ifgp++; + } } + IFNET_RUNLOCK(); - return (0); + return (error); } /* @@ -2756,14 +2752,8 @@ ifhwioctl(u_long cmd, struct ifnet *ifp, caddr_t data, struct thread *td) break; } case SIOCGIFGROUP: - { - struct epoch_tracker et; - - NET_EPOCH_ENTER(et); error = if_getgroup((struct ifgroupreq *)data, ifp); - NET_EPOCH_EXIT(et); break; - } case SIOCDIFGROUP: { diff --git a/sys/net/if_private.h b/sys/net/if_private.h index c4ade7308df4..5a76fd788c1b 100644 --- a/sys/net/if_private.h +++ b/sys/net/if_private.h @@ -41,7 +41,7 @@ struct ifnet { CK_STAILQ_ENTRY(ifnet) if_link; /* all struct ifnets are chained (CK_) */ LIST_ENTRY(ifnet) if_clones; /* interfaces of a cloner */ CK_STAILQ_HEAD(, ifg_list) if_groups; /* linked list of groups per if (CK_) */ - /* protected by if_addr_lock */ + /* protected by ifnet_sxlock */ u_char if_alloctype; /* if_type at time of allocation */ uint8_t if_numa_domain; /* NUMA domain of device */ /* Driver and protocol specific information that remains stable. */