From nobody Thu Apr 30 09:53:19 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4g5qHN19VSz6bWDm for ; Thu, 30 Apr 2026 09:53:20 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R13" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4g5qHM6Gcnz3DkT for ; Thu, 30 Apr 2026 09:53:19 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1777542799; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=i69zZWVSH958VoVCQZAE/0z1Y2ADhJuNFEjdMCpGPWk=; b=GXAwNMGhB+j+MEiIGrGgHfwpFoYxAx+KV5b5Kc5VOQVXeH3+UqFrX0dhIjAFIAyhHnJizL rGIGfQQAJQ7TvbvX1NrK+GIeZ8ybVP1wJGNhelTcXy7HRrwFws4RrKsFDQXo+HgvyQrtYv u0FXgA7HfjPNzizImbDXPwXjmcR3ufYwVynFMb9IRtGzd4BvQ+szWZUUbNRKfqBXaW42Qj 8oUQthSZglgtPTURNqHEZq3hFTaE5qRnBnMC45LQba1o+Eaip5uIFzF0IxvkcQ7vBBDVpf CqwxtdhD7WiuFDe3G+mOlm1fPCMpIXXqgVDw24LtUWWqBRHIumfPvZNiRByR7w== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1777542799; a=rsa-sha256; cv=none; b=SqcyytpN+h3fjarO9OmKJ07bczSiyojXwl1gZ123Eedkp+7gUSTJD8sQ660SLYAaOl5/3Q lqo25HDBcq8NC4EKFXUeR3HhGnzwBBlphniePqiYHdS6nPhuYAh5WuQDfVNB6SyYiPjM4D 5hpH3M75fkFFI5WKYD32fNj94EhpxQVB/qzDPck7CYWAcsYuyoT2BcI/PFS6C13XJtlte0 YyBlA7Mmpv17xGhW/1g1H0rMfhUwm8qngndNEHO4nwy3mMEO0FlpDkdP/i1RFsa7OAkXbb 79F1qufuuvmjFjzs2xm6DUNFeKq1K5LyibMlUf01Y7HE4XAopnfuMG41UtQyiw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1777542799; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=i69zZWVSH958VoVCQZAE/0z1Y2ADhJuNFEjdMCpGPWk=; b=dYOVwYjc85NnoTYq4GD4A2fnpoVcd/4+KeOw3l62gDd4kSNWtZgpwEignYPUMS2RpHfj4a wraqXVN+dRaIT+Nkvn0vE98XZPIHWafTqAX+Gccxa6VtwPWFgI1mhVvs+m763tA6Lgvnn7 ZmoMOZMCyOk2ZIlPBkP2bT4mU3ir7fXg1h7NCqshPB6HSq4fY5FLubzkBJxM8BVtI0HxIM FC8C5lLrR5A+m9NpDxbqXIRONSbzWHF3ps6Nkvy8UO+Iuvba9uwi5lk5+O53d8RAuQWnhQ MshKp1xcx2V53QQ6XTtfz58ZQq642FeyhFujb5gtH0CjyqhSwT+ZEEyt3wg2aQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4g5qHM5jN5z1LNK for ; Thu, 30 Apr 2026 09:53:19 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 46a68 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Thu, 30 Apr 2026 09:53:19 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Zhenlei Huang Subject: git: cef2f7b440ff - stable/15 - ifnet: Fix races in if_vmove_reclaim() List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: zlei X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: cef2f7b440ffa67271690a6aba532e4c090772db Auto-Submitted: auto-generated Date: Thu, 30 Apr 2026 09:53:19 +0000 Message-Id: <69f3268f.46a68.3166c501@gitrepo.freebsd.org> The branch stable/15 has been updated by zlei: URL: https://cgit.FreeBSD.org/src/commit/?id=cef2f7b440ffa67271690a6aba532e4c090772db commit cef2f7b440ffa67271690a6aba532e4c090772db Author: Zhenlei Huang AuthorDate: 2026-03-30 16:00:01 +0000 Commit: Zhenlei Huang CommitDate: 2026-04-30 09:51:59 +0000 ifnet: Fix races in if_vmove_reclaim() The thread running if_vmove_reclaim() may race with other threads those running if_detach(), if_vmove_loan() or if_vmove_reclaim(). In case the current thread loses race, two issues arise, 1. It is unstable and unsafe to access ifp->if_vnet, 2. The interface is removed from "active" list, hence if_unlink_ifnet() can fail. For the first case, check against source prison's vnet instead, given the interface is obtained from that vnet. For the second one, return ENODEV to indicate the interface was on the list but the current thread loses race, to distinguish from ENXIO, which means the interface or child prison is not found. This is the same with if_vmove_loan(). Reviewed by: kp, pouria Fixes: a779388f8bb3 if: Protect V_ifnet in vnet_if_return() MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D55997 (cherry picked from commit ee9456ce37539da5b651945eea18502f290eb133) --- sys/net/if.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/sys/net/if.c b/sys/net/if.c index 71a4585ae7eb..aeb264f2ac3f 100644 --- a/sys/net/if.c +++ b/sys/net/if.c @@ -1351,7 +1351,7 @@ if_vmove_reclaim(struct thread *td, char *ifname, int jid) struct prison *pr; struct vnet *vnet_dst; struct ifnet *ifp; - int found __diagused; + int found; /* Try to find the prison within our visibility. */ sx_slock(&allprison_lock); @@ -1364,16 +1364,16 @@ if_vmove_reclaim(struct thread *td, char *ifname, int jid) /* Make sure the named iface exists in the source prison/vnet. */ CURVNET_SET(pr->pr_vnet); - ifp = ifunit(ifname); /* XXX Lock to avoid races. */ + ifp = ifunit(ifname); if (ifp == NULL) { CURVNET_RESTORE(); prison_free(pr); return (ENXIO); } - /* Do not try to move the iface from and to the same prison. */ + /* Do not try to move the iface from and to the same vnet. */ vnet_dst = TD_TO_VNET(td); - if (vnet_dst == ifp->if_vnet) { + if (vnet_dst == pr->pr_vnet) { CURVNET_RESTORE(); prison_free(pr); return (EEXIST); @@ -1381,7 +1381,11 @@ if_vmove_reclaim(struct thread *td, char *ifname, int jid) /* Get interface back from child jail/vnet. */ found = if_unlink_ifnet(ifp, true); - MPASS(found); + if (! found) { + CURVNET_RESTORE(); + prison_free(pr); + return (ENODEV); + } sx_xlock(&ifnet_detach_sxlock); if_vmove(ifp, vnet_dst); sx_xunlock(&ifnet_detach_sxlock);