From nobody Mon May 4 16:51:13 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4g8SMk22mCz6brF3 for ; Mon, 04 May 2026 16:51:14 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R13" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4g8SMj3PZHz3w4f for ; Mon, 04 May 2026 16:51:13 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1777913473; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=cXVXJwSixNVblenOY0fd3URBdPrmx054N2UDxLM5RO4=; b=N+Qfs28wycEWulvA/V9bbTCKtNIrOQhg04uyvVOQ7XPNRvcyfGCp6cx17uez0D8XtWKy/I egUoBtjvs1uwvQuTCjpTyIUlcA7gaLxFDLqBwy7wzlqYmDPT5f8SHkU8dnL9rdru0TI4jN XiX7ZoI+TxzYRw36ZQdT+8hv61oUSJabXNhSKYMUo8zd9twNcWv6OGVu2sGgZKW2NrxxSx Z7v2A9mBJ8UaMmEDKnjaIjBravE7nVvk2NM5YSwxKgwRGXNSoBcOQnCEpSX91xZbloFhzy Jx/DE+K7xdIuSMJjGnMlyglaZVmYo0MyntUR3NXzes6UI/GfuIAdHv337IlMtQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1777913473; a=rsa-sha256; cv=none; b=Fqm3USHTqj0u52Qg9yYUYQhZL+ATk/TPkjatSikVfbM1Rga/iW7Vb8sSHL91O3SCcqXZgs Y33F3TgOQ+5LnvBtgeCDXJRayX0aD93Z3VuDQVaWX3GBvguX3dLMLs9Kgp37dIGz+LEXNl gphJm3ZKQNLSK9YJYJ1a0tV+zJHHUboie0jiSg+2CigN8AFSOZC2daNn4cUSHfYaQsLG1k tuH9jz1op3OCK71+Lz5Da/PhXBXfV/TVAOwlO8d46NmzkaqtwNu7+e2dlmqro/SDbf2c3b Y9YaRckpd/GWdV3sSDFsMYWxjSuhO4FOeie8YNMaqFpbjZ55JHgG3WJDjEKEdw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1777913473; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=cXVXJwSixNVblenOY0fd3URBdPrmx054N2UDxLM5RO4=; b=ExI5DyKlcn9J45MFsSoPle90GWpDoCcEm7UkMIOG8XJDX2fC0geO4ya1FMXkSqHLcwrcku DUHXiWwPgVhpO/avc2F9+2nk0l/R1vTcGSW/MARqSksjmStLLig2/cIgWIJk0RXcxdcWtZ A57O1o0HNGNUoRG4qK6kBw9eWrHbFYjT5wqk8wshNgJUVxyg7b3Q7GQECkI2OhS0VMDq8B GtR9Nu3238tZ7Z++nu5MleAElbklXMq/YFtpI+TZY5hp32j3POhRGjxLwius5IHgOYeFV5 QBqaM0x0xB3XQyR1m2gTlvjoWTZ/VG9dcB7P667H3YA3JBqg9XiwcSmDhT/B5Q== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4g8SMj31CzzClt for ; Mon, 04 May 2026 16:51:13 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 26b8f by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 04 May 2026 16:51:13 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Zhenlei Huang Subject: git: f7145eff8172 - stable/14 - ifnet: Fix races in if_vmove_reclaim() List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: zlei X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: f7145eff8172cbcaffb36c1d13aae0e438759a7c Auto-Submitted: auto-generated Date: Mon, 04 May 2026 16:51:13 +0000 Message-Id: <69f8ce81.26b8f.67a6c9d7@gitrepo.freebsd.org> The branch stable/14 has been updated by zlei: URL: https://cgit.FreeBSD.org/src/commit/?id=f7145eff8172cbcaffb36c1d13aae0e438759a7c commit f7145eff8172cbcaffb36c1d13aae0e438759a7c Author: Zhenlei Huang AuthorDate: 2026-03-30 16:00:01 +0000 Commit: Zhenlei Huang CommitDate: 2026-05-04 16:49:40 +0000 ifnet: Fix races in if_vmove_reclaim() The thread running if_vmove_reclaim() may race with other threads those running if_detach(), if_vmove_loan() or if_vmove_reclaim(). In case the current thread loses race, two issues arise, 1. It is unstable and unsafe to access ifp->if_vnet, 2. The interface is removed from "active" list, hence if_unlink_ifnet() can fail. For the first case, check against source prison's vnet instead, given the interface is obtained from that vnet. For the second one, return ENODEV to indicate the interface was on the list but the current thread loses race, to distinguish from ENXIO, which means the interface or child prison is not found. This is the same with if_vmove_loan(). Reviewed by: kp, pouria Fixes: a779388f8bb3 if: Protect V_ifnet in vnet_if_return() MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D55997 (cherry picked from commit ee9456ce37539da5b651945eea18502f290eb133) (cherry picked from commit cef2f7b440ffa67271690a6aba532e4c090772db) --- sys/net/if.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/sys/net/if.c b/sys/net/if.c index 2245863bda83..55c81b7c931b 100644 --- a/sys/net/if.c +++ b/sys/net/if.c @@ -1355,7 +1355,7 @@ if_vmove_reclaim(struct thread *td, char *ifname, int jid) struct prison *pr; struct vnet *vnet_dst; struct ifnet *ifp; - int found __diagused; + int found; /* Try to find the prison within our visibility. */ sx_slock(&allprison_lock); @@ -1368,16 +1368,16 @@ if_vmove_reclaim(struct thread *td, char *ifname, int jid) /* Make sure the named iface exists in the source prison/vnet. */ CURVNET_SET(pr->pr_vnet); - ifp = ifunit(ifname); /* XXX Lock to avoid races. */ + ifp = ifunit(ifname); if (ifp == NULL) { CURVNET_RESTORE(); prison_free(pr); return (ENXIO); } - /* Do not try to move the iface from and to the same prison. */ + /* Do not try to move the iface from and to the same vnet. */ vnet_dst = TD_TO_VNET(td); - if (vnet_dst == ifp->if_vnet) { + if (vnet_dst == pr->pr_vnet) { CURVNET_RESTORE(); prison_free(pr); return (EEXIST); @@ -1385,7 +1385,11 @@ if_vmove_reclaim(struct thread *td, char *ifname, int jid) /* Get interface back from child jail/vnet. */ found = if_unlink_ifnet(ifp, true); - MPASS(found); + if (! found) { + CURVNET_RESTORE(); + prison_free(pr); + return (ENODEV); + } sx_xlock(&ifnet_detach_sxlock); if_vmove(ifp, vnet_dst); sx_xunlock(&ifnet_detach_sxlock);