From nobody Mon Jun 15 18:01:53 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gfHxt2QXgz6hhLV for ; Mon, 15 Jun 2026 18:01:54 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R13" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gfHxs5fZHz4F18 for ; Mon, 15 Jun 2026 18:01:53 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1781546513; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=uPuU3sFy9Z2FBKYOeCnOpF41E9ue7b1BSdfin9DEV6g=; b=faPkPxxs/4DD/Q1pv8Cw/olUPHK9cKXPiLnWbmfqFo3clmJieLLwrgDzErT2egrosli61X smNZVjlKjdoqpoWfqaOK6zSnHdkUGfp3hPAfIdjJv3UV7D2ZfjiP9/FhlGzz21njbnJZAx LlnaFzP/ENJAAXRjtSMuxEym0k76LjCcAIi5GhMswu4YIMbtZEmOYAF2Fu5bjeWkh+o/lB nxYRsGTrk0lK3SqzM1NtuJsCG7xc68IedThgE0TP6RFxYF8cQpFHkN3FarGBc50rJpRzUA 5MfGdi/iVqTpqRUMfm0HFlETym0LhO4OC++dU/Wd7w4iSusuVKQ2JOpqig5aDw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1781546513; a=rsa-sha256; cv=none; b=l8bo23cBFI9vjoLKDxQS2ZKw5Gnjh2gad7Y8tCJLQykBwgOX0+CLiSgE9Ve3hy8F7WrhsB kf7pBca5FhqafQ6rTaoTcnLY3j9s1faMz5niaGAOuQbUKIXuwqW6C3njLLi/XccjyJ/DCU cinXSgy8UX0AO6JdiAaXyJSo6fX05PkmLNaMdZT8XARLfTBFD6gPqV+TYCt0IbRi1E8b3f hwLk8zuH8kKlHhFtGNYQc+VVFPLyTBBdvuRQ262kjP54bsPLqHMtFjCf2pnR7wy2feXcR8 HUD5CkW1zBV8W4tR2x0ucku+Y9wXer1ZunxR60yPQH+0rHJXWLLi75+g55IHGQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1781546513; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=uPuU3sFy9Z2FBKYOeCnOpF41E9ue7b1BSdfin9DEV6g=; b=lmdmfbRvtS/D+V1oJjKypL+c4lMuDqJ9J7YNca6QuWVMdqcmZO+rKd3MxDC/2NcRN71hae qDVjVjY6F7OkCDnOHS21wTxaQ6Oh2754f4KvhSq12AhwJGa2gkjsvG3p7ZA51cYbuYrM33 9IGqSZn99OR/tewUQbzUgKAuoA2Fmb1y91tVQofhr+YojTjHx/D8+7GVZ09hDMSL3fXcnD VsoaWyO+eG9bjocsz4Yinrqn7Gs0/1LoF/tBxc2TfwZeRJNW1fuNt0idV+FF6ko4nbZNoo 1RqY/fTWEuOsN0BFvQfwSlooVOt0VJ4hjudxltLa7yOLyGhc0xReB3J7PsFlBg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gfHxs54Gpz15J8 for ; Mon, 15 Jun 2026 18:01:53 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 20254 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 15 Jun 2026 18:01:53 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 8da837bba1de - stable/15 - net: Fix handling of unmapped user pages in if_getgroup() List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 8da837bba1de7c9fb754dbed87378cb6815a89fa Auto-Submitted: auto-generated Date: Mon, 15 Jun 2026 18:01:53 +0000 Message-Id: <6a303e11.20254.518059cd@gitrepo.freebsd.org> The branch stable/15 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=8da837bba1de7c9fb754dbed87378cb6815a89fa commit 8da837bba1de7c9fb754dbed87378cb6815a89fa Author: Mark Johnston AuthorDate: 2026-06-01 16:44:15 +0000 Commit: Mark Johnston CommitDate: 2026-06-15 16:00:04 +0000 net: Fix handling of unmapped user pages in if_getgroup() We cannot call copyout() while in a net epoch section, unless the user memory is wired. Use the global ifnet lock to synchronize the accesses instead. Reported by: emaste Reviewed by: zlei MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D57154 (cherry picked from commit 68004e56fdc22c11b4ec680e83309b4ea2bfe13a) --- sys/net/if.c | 56 +++++++++++++++++++++------------------------------- sys/net/if_private.h | 2 +- 2 files changed, 24 insertions(+), 34 deletions(-) diff --git a/sys/net/if.c b/sys/net/if.c index 0252ea742f66..ed22bbd8f8da 100644 --- a/sys/net/if.c +++ b/sys/net/if.c @@ -1484,11 +1484,8 @@ if_addgroup(struct ifnet *ifp, const char *groupname) ifgl->ifgl_group = ifg; ifgm->ifgm_ifp = ifp; - IF_ADDR_WLOCK(ifp); CK_STAILQ_INSERT_TAIL(&ifg->ifg_members, ifgm, ifgm_next); CK_STAILQ_INSERT_TAIL(&ifp->if_groups, ifgl, ifgl_next); - IF_ADDR_WUNLOCK(ifp); - IFNET_WUNLOCK(); if (new) @@ -1511,9 +1508,7 @@ _if_delgroup_locked(struct ifnet *ifp, struct ifg_list *ifgl, IFNET_WLOCK_ASSERT(); - IF_ADDR_WLOCK(ifp); CK_STAILQ_REMOVE(&ifp->if_groups, ifgl, ifg_list, ifgl_next); - IF_ADDR_WUNLOCK(ifp); CK_STAILQ_FOREACH(ifgm, &ifgl->ifgl_group->ifg_members, ifgm_next) { if (ifgm->ifgm_ifp == ifp) { @@ -1588,34 +1583,35 @@ if_delgroups(struct ifnet *ifp) static int if_getgroup(struct ifgroupreq *ifgr, struct ifnet *ifp) { - int len, error; - struct ifg_list *ifgl; - struct ifg_req ifgrq, *ifgp; - - NET_EPOCH_ASSERT(); + struct ifg_list *ifgl; + struct ifg_req ifgrq, *ifgp; + int len, error; + IFNET_RLOCK(); if (ifgr->ifgr_len == 0) { CK_STAILQ_FOREACH(ifgl, &ifp->if_groups, ifgl_next) ifgr->ifgr_len += sizeof(struct ifg_req); - return (0); - } - - len = ifgr->ifgr_len; - ifgp = ifgr->ifgr_groups; - /* XXX: wire */ - CK_STAILQ_FOREACH(ifgl, &ifp->if_groups, ifgl_next) { - if (len < sizeof(ifgrq)) - return (EINVAL); - bzero(&ifgrq, sizeof ifgrq); - strlcpy(ifgrq.ifgrq_group, ifgl->ifgl_group->ifg_group, - sizeof(ifgrq.ifgrq_group)); - if ((error = copyout(&ifgrq, ifgp, sizeof(struct ifg_req)))) - return (error); - len -= sizeof(ifgrq); - ifgp++; + error = 0; + } else { + len = ifgr->ifgr_len; + ifgp = ifgr->ifgr_groups; + CK_STAILQ_FOREACH(ifgl, &ifp->if_groups, ifgl_next) { + if (len < sizeof(ifgrq)) { + error = EINVAL; + break; + } + bzero(&ifgrq, sizeof ifgrq); + strlcpy(ifgrq.ifgrq_group, ifgl->ifgl_group->ifg_group, + sizeof(ifgrq.ifgrq_group)); + if ((error = copyout(&ifgrq, ifgp, sizeof(struct ifg_req)))) + break; + len -= sizeof(ifgrq); + ifgp++; + } } + IFNET_RUNLOCK(); - return (0); + return (error); } /* @@ -2867,14 +2863,8 @@ ifhwioctl(u_long cmd, struct ifnet *ifp, caddr_t data, struct thread *td) break; } case SIOCGIFGROUP: - { - struct epoch_tracker et; - - NET_EPOCH_ENTER(et); error = if_getgroup((struct ifgroupreq *)data, ifp); - NET_EPOCH_EXIT(et); break; - } case SIOCDIFGROUP: { diff --git a/sys/net/if_private.h b/sys/net/if_private.h index 3da529e6b22e..a5cc09127f6f 100644 --- a/sys/net/if_private.h +++ b/sys/net/if_private.h @@ -41,7 +41,7 @@ struct ifnet { CK_STAILQ_ENTRY(ifnet) if_link; /* all struct ifnets are chained (CK_) */ LIST_ENTRY(ifnet) if_clones; /* interfaces of a cloner */ CK_STAILQ_HEAD(, ifg_list) if_groups; /* linked list of groups per if (CK_) */ - /* protected by if_addr_lock */ + /* protected by ifnet_sxlock */ u_char if_alloctype; /* if_type at time of allocation */ uint8_t if_numa_domain; /* NUMA domain of device */ /* Driver and protocol specific information that remains stable. */