From owner-freebsd-net@FreeBSD.ORG Mon May 26 09:25:08 2014 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 489EC59F for ; Mon, 26 May 2014 09:25:08 +0000 (UTC) Received: from mx1.sbone.de (mx1.sbone.de [IPv6:2a01:4f8:130:3ffc::401:25]) (using TLSv1 with cipher DHE-RSA-CAMELLIA256-SHA (256/256 bits)) (Client CN "mx1.sbone.de", Issuer "SBone.DE" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 003802BA8 for ; Mon, 26 May 2014 09:25:07 +0000 (UTC) Received: from mail.sbone.de (mail.sbone.de [IPv6:fde9:577b:c1a9:31::2013:587]) (using TLSv1 with cipher ADH-CAMELLIA256-SHA (256/256 bits)) (No client certificate requested) by mx1.sbone.de (Postfix) with ESMTPS id 7FAFB25D3810; Mon, 26 May 2014 09:25:05 +0000 (UTC) Received: from content-filter.sbone.de (content-filter.sbone.de [IPv6:fde9:577b:c1a9:31::2013:2742]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.sbone.de (Postfix) with ESMTPS id AA4EAC22BFD; Mon, 26 May 2014 09:25:04 +0000 (UTC) X-Virus-Scanned: amavisd-new at sbone.de Received: from mail.sbone.de ([IPv6:fde9:577b:c1a9:31::2013:587]) by content-filter.sbone.de (content-filter.sbone.de [fde9:577b:c1a9:31::2013:2742]) (amavisd-new, port 10024) with ESMTP id TCBAFir-Mxmz; Mon, 26 May 2014 09:25:03 +0000 (UTC) Received: from [IPv6:fde9:577b:c1a9:4410:d98d:32f5:c3e6:8937] (unknown [IPv6:fde9:577b:c1a9:4410:d98d:32f5:c3e6:8937]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by mail.sbone.de (Postfix) with ESMTPSA id B4331C22BF5; Mon, 26 May 2014 09:25:01 +0000 (UTC) Content-Type: text/plain; charset=windows-1252 Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.2\)) Subject: Re: Problem: no locking around IPv6 prefix structures in prelist_remove From: "Bjoern A. Zeeb" In-Reply-To: <53830546.1080309@netasq.com> Date: Mon, 26 May 2014 09:24:42 +0000 Content-Transfer-Encoding: quoted-printable Message-Id: <232CE242-ECDD-4627-AE44-8265B9CC4690@FreeBSD.org> References: <53830546.1080309@netasq.com> To: Steve Read X-Mailer: Apple Mail (2.1878.2) Cc: freebsd-net@freebsd.org X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 26 May 2014 09:25:08 -0000 On 26 May 2014, at 09:11 , Steve Read wrote: > I have recently encountered an interesting double-free crash in = prelist_remove() (management of IPv6 prefixes used by interface = addresses) using a modified version of 9.2. We've seen this once. >=20 > It appears that two userland threads tried simultaneously to remove = the last interface address that referenced a particular prefix, and = both, therefore, tried to remove it from the global list of prefixes. = (Feel free to correct my interpretation of the purpose of prelist_remove = and how it is invoked.) One of them succeeded, and the other was left = holding a chunk of free()ed memory, and crashed when trying to delete = it. >=20 > I looked at the code surrounding this function, and I can find no sign = of locking around the prefix list or, indeed, anywhere in the call-stack = (sys_ioctl=3D>kern_ioctl=3D>soo_ioctl=3D=3D>ifi_ioctl=3D>in6_control=3D>pr= elist_remove). I looked in HEAD, and this part of the code appears to be = more or less the same, in particular the question of locking. >=20 > Should I submit a PR (no, we can't retry with a generic kernel)? No need to for either. markj@ has a patch to fix a good deal of racy prefix list locking which = needs review and testing. =97=20 Bjoern A. Zeeb "Come on. Learn, goddamn it.", WarGames, 1983