Date: Mon, 27 Sep 2021 19:32:08 +0000 From: bugzilla-noreply@freebsd.org To: bugs@FreeBSD.org Subject: [Bug 258751] race between pfi_kkif_update() and if_addgroup() Message-ID: <bug-258751-227@https.bugs.freebsd.org/bugzilla/>
next in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D258751 Bug ID: 258751 Summary: race between pfi_kkif_update() and if_addgroup() Product: Base System Version: CURRENT Hardware: Any OS: Any Status: New Severity: Affects Only Me Priority: --- Component: kern Assignee: bugs@FreeBSD.org Reporter: markj@FreeBSD.org We have the following syzbot report: https://syzkaller.appspot.com/bug?id=3D6698f3333928ca407039fd0bbe9238983681= 936f The crash happened right after the fuzzer started, at a point where it would have been creating a number of tun interfaces for packet injection. I susp= ect the following race is possible: - Thread 1 creates a tun interface, which is automatically added to an interface group. if_addgroup() creates the new interface group and adds the new interface to it. Then it drops locks before generating the group_attach_event event, and is preempted. - Thread 2 creates a second tun interface. The group is already created so= the group_attach_event event handlers do not run. - Thread 2 assigns an interface address. This runs ifaddr_event event handlers, including pfi_ifaddr_event(), which calls pfi_kkif_update().=20 pfi_kkif_update() recurses and is called on the new interface's containing groups, including the one that thread 1 is still constructing. - Thread 2 panics: thread 1 has created the group but the ifg_pf_kif field = is uninitialized. We could modify if_addgroup() to initialize the ifg_pf_kif field to NULL, a= nd modify pfi_kkif_update() to handle a NULL ifg_pf_kif, but I'm not sure that this is correct. --=20 You are receiving this mail because: You are the assignee for the bug.=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-258751-227>