From nobody Fri Jan 23 22:36:45 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4dyXq159Mkz6Pss8 for ; Fri, 23 Jan 2026 22:36:45 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R13" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4dyXq10hFnz3qrW for ; Fri, 23 Jan 2026 22:36:45 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1769207805; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=V7q0wH13mO86REQufApJXpjthn9iprhA4kztfDjA+g4=; b=omyoshPxV4FYEAu49T/kJ8rjESRDJ1Vu21TFh7riifxcx5zZ+11bTlIVwAUUohvlxzll+f 1YPW6AtaJ6CeYOpG4XN/kVwiYVc3+8tlxTxm24kW4AkJbOUTJZsmYhdZ3BHvYtWQ+i/Sn5 NOKMbLZz0i73uy3gt7WwBx69kOVqS0TBQ6KK7nHQlsXsZ2G7jx0KmF7vZaMmVtZoQnrorx 9URRoVX5cgvXwNgRqt3CQNZl3z1D92BCALm0UmdXVXDspK5LpwphMEwP12tiVx6ofScIcG PfPvCfk8njRqPnV+79LmGvqTZS+t6jR8sol+p5XKTXvHYlG53qKsvMnuacxwLw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1769207805; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=V7q0wH13mO86REQufApJXpjthn9iprhA4kztfDjA+g4=; b=Nrlpj/HmQFm+zcfvw2wLdicAGlk7YUOXnnjAMYBWGnBLZe6tkBSOOG25MmuijxTHRONMH3 cIBPrIDe1KSl9xfpWcJ9qxc2HX5uOMvE+0fpJLuKQB0pbH5pM/5J3oOQs8p+J8nwOSowIo j2ciu30C0nU1IF2+z/tiXnFJqKrNuluMrVw/1cpycA960Ycv96yFtlQyszbkN7SZ3xWgxu 3WkkTWxZkcbrn3iBFoxYVxpMeEs5ptr2/b1JZESlxaFbVRgWz7aLYatPB5MnReJxN0Ozth cmwWdm/n2OG5AONib6TO/y1RzAOSEzQUgPKYDwdDtNQYBHlUImUx8GKK8jDFTQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1769207805; a=rsa-sha256; cv=none; b=TnzrmoC0sF1oRf08PXyM6qeJJpf8Tb62R8hloq20HUk1teAk6YUoAze4qZMPXpMoQqm2km sQ32MpxXW7wm4WbxWBzrs0IHZbRfRpLigsFrQxTr/KKBxdArnEE0rkz6vR4QELfjq0fByF Dizvj/7/LmwbaOwMARzJUVGCGbRjTqC8cuWP2E6eD2n9TrYluzhcO3JQ1PTYSrV4DU0j/J ljS74NEwSBq8/+ymePgEk7lSTD7fzwWcZ7vjSsGGXECr19q8nO2q18oM7gg6p0WJ+F4I5H pA0HCbJ60tfOIIRhKiS4zANeW+dYk/Jn17LvyHeLBCIO8In7BsnDxxGmpb6ftA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4dyXq10D9czfNP for ; Fri, 23 Jan 2026 22:36:45 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 36a43 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Fri, 23 Jan 2026 22:36:45 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Gleb Smirnoff Subject: git: f3de667137e9 - main - netinet6: free in6_ifextra with epoch_call(9) List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: glebius X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: f3de667137e90679cd20fa5c1dcd93a4c51ad848 Auto-Submitted: auto-generated Date: Fri, 23 Jan 2026 22:36:45 +0000 Message-Id: <6973f7fd.36a43.77ce42d6@gitrepo.freebsd.org> The branch main has been updated by glebius: URL: https://cgit.FreeBSD.org/src/commit/?id=f3de667137e90679cd20fa5c1dcd93a4c51ad848 commit f3de667137e90679cd20fa5c1dcd93a4c51ad848 Author: Gleb Smirnoff AuthorDate: 2026-01-23 22:18:18 +0000 Commit: Gleb Smirnoff CommitDate: 2026-01-23 22:18:18 +0000 netinet6: free in6_ifextra with epoch_call(9) This is expected to fix the old in6_selecthlim() panics. The nature of the panic is that a packet sending thread will obtain the struct ifnet pointer locklessly and then pick the if_inet6 pointer from it and dereference it. While the struct ifnet is freed via epoch_call(9), the struct in6_ifextra until this change was not. For the forwarded packets, or locally originated non-TCP packets we were probably safe due to the old if_dead trick. But locally originated TCP packets may dereference in6_ifextra via direct call into in6_selecthlim() from the tcp_output(), before ip6_output(). NB: hypothetically a similar problem also applies to IPv4's if_inet pointer, but there are no known panics, yet. PR: 279653 Reviewed by: tuexen Differential Revision: https://reviews.freebsd.org/D54728 --- sys/netinet6/in6_ifattach.c | 25 ++++++++++++++++++++----- sys/netinet6/in6_var.h | 2 ++ 2 files changed, 22 insertions(+), 5 deletions(-) diff --git a/sys/netinet6/in6_ifattach.c b/sys/netinet6/in6_ifattach.c index b9ce64e5b86b..c38fe90632f8 100644 --- a/sys/netinet6/in6_ifattach.c +++ b/sys/netinet6/in6_ifattach.c @@ -899,6 +899,19 @@ in6_ifdetach(struct ifnet *ifp) _in6_ifdetach(ifp, 1); } +static void +in6_ifextra_free(epoch_context_t ctx) +{ + struct in6_ifextra *ext = + __containerof(ctx, struct in6_ifextra, epoch_ctx); + + COUNTER_ARRAY_FREE(ext->in6_ifstat, + sizeof(struct in6_ifstat) / sizeof(uint64_t)); + COUNTER_ARRAY_FREE(ext->icmp6_ifstat, + sizeof(struct icmp6_ifstat) / sizeof(uint64_t)); + free(ext, M_IFADDR); +} + static void in6_ifdeparture(void *arg __unused, struct ifnet *ifp) { @@ -916,14 +929,16 @@ in6_ifdeparture(void *arg __unused, struct ifnet *ifp) if (!VNET_IS_SHUTTING_DOWN(ifp->if_vnet)) #endif _in6_ifdetach(ifp, 1); + /* + * XXXGL: mld and nd bits are left in a consistent state after + * destructors, but I'm not sure if it safe to call lltable_free() here. + * Individual lle entries are epoch(9) protected, but the table itself + * isn't. + */ mld_domifdetach(ifp); nd6_ifdetach(ifp); lltable_free(ext->lltable); - COUNTER_ARRAY_FREE(ext->in6_ifstat, - sizeof(struct in6_ifstat) / sizeof(uint64_t)); - COUNTER_ARRAY_FREE(ext->icmp6_ifstat, - sizeof(struct icmp6_ifstat) / sizeof(uint64_t)); - free(ext, M_IFADDR); + NET_EPOCH_CALL(in6_ifextra_free, &ext->epoch_ctx); } EVENTHANDLER_DEFINE(ifnet_departure_event, in6_ifdeparture, NULL, EVENTHANDLER_PRI_ANY); diff --git a/sys/netinet6/in6_var.h b/sys/netinet6/in6_var.h index 894628b796d1..057cd84b6ea7 100644 --- a/sys/netinet6/in6_var.h +++ b/sys/netinet6/in6_var.h @@ -531,6 +531,8 @@ struct in6_ifextra { } scope6_id; struct lltable *lltable; + + struct epoch_context epoch_ctx; }; #define LLTABLE6(ifp) ((ifp)->if_inet6->lltable)