Skip site navigation (1)Skip section navigation (2) 
Date:      Mon, 15 Jun 2026 18:01:51 +0000
From:      Mark Johnston <markj@FreeBSD.org>
To:        src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org
Subject:   git: c511c9eee2a1 - stable/15 - lagg: Handle a port count of zero
Message-ID:  <6a303e0f.1ddf3.5c2b70c@gitrepo.freebsd.org>
index | next in thread | raw e-mail 

The branch stable/15 has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=c511c9eee2a1dbdbf83ca8ea92193766ddb640ff

commit c511c9eee2a1dbdbf83ca8ea92193766ddb640ff
Author:     Mark Johnston <markj@FreeBSD.org>
AuthorDate: 2026-06-01 16:40:43 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2026-06-15 16:00:04 +0000

    lagg: Handle a port count of zero
    
    The sc_count check in lagg_transmit_ethernet() and
    lagg_transmit_infiniband() is racy, as the lagg protocol handlers are
    only synchronized by net_epoch.  Handle a count of 0 in each protocol
    handler where it's needed, namely in the RR and LB handlers.
    
    Reported by:    Yuxiang Yang, Yizhou Zhao, Xuewei Feng, Qi Li, and Ke Xu from Tsinghua University using GLM5.1 from Z.ai
    Reviewed by:    pouria, zlei
    MFC after:      2 weeks
    Differential Revision:  https://reviews.freebsd.org/D56942
    
    (cherry picked from commit 49d90d9ddfc1ecda9ad9b6cb5565e5fbdcc14964)
---
 sys/net/if_lagg.c | 40 +++++++++++++++++++++++-----------------
 1 file changed, 23 insertions(+), 17 deletions(-)

diff --git a/sys/net/if_lagg.c b/sys/net/if_lagg.c
index 23ad4f72d255..5a2ec97e4aa4 100644
--- a/sys/net/if_lagg.c
+++ b/sys/net/if_lagg.c
@@ -1831,6 +1831,7 @@ lookup_snd_tag_port(struct ifnet *ifp, uint32_t flowid, uint32_t flowtype,
 	struct lagg_port *lp;
 	struct lagg_lb *lb;
 	uint32_t hash, p;
+	unsigned int count;
 	int err;
 
 	sc = ifp->if_softc;
@@ -1842,8 +1843,11 @@ lookup_snd_tag_port(struct ifnet *ifp, uint32_t flowid, uint32_t flowtype,
 		if ((sc->sc_opts & LAGG_OPT_USE_FLOWID) == 0 ||
 		    flowtype == M_HASHTYPE_NONE)
 			return (NULL);
+		count = atomic_load_int(&sc->sc_count);
+		if (count == 0)
+			return (NULL);
 		p = flowid >> sc->flowid_shift;
-		p %= sc->sc_count;
+		p %= count;
 		lb = (struct lagg_lb *)sc->sc_psc;
 		lp = lb->lb_ports[p];
 		return (lagg_link_active(sc, lp));
@@ -2131,12 +2135,6 @@ lagg_transmit_ethernet(struct ifnet *ifp, struct mbuf *m)
 	if (m->m_pkthdr.csum_flags & CSUM_SND_TAG)
 		MPASS(m->m_pkthdr.snd_tag->ifp == ifp);
 #endif
-	/* We need at least one port */
-	if (sc->sc_count == 0) {
-		m_freem(m);
-		if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
-		return (ENXIO);
-	}
 
 	ETHER_BPF_MTAP(ifp, m);
 
@@ -2153,12 +2151,6 @@ lagg_transmit_infiniband(struct ifnet *ifp, struct mbuf *m)
 	if (m->m_pkthdr.csum_flags & CSUM_SND_TAG)
 		MPASS(m->m_pkthdr.snd_tag->ifp == ifp);
 #endif
-	/* We need at least one port */
-	if (sc->sc_count == 0) {
-		m_freem(m);
-		if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
-		return (ENXIO);
-	}
 
 	infiniband_bpf_mtap(ifp, m);
 
@@ -2424,13 +2416,20 @@ lagg_rr_start(struct lagg_softc *sc, struct mbuf *m)
 {
 	struct lagg_port *lp;
 	uint32_t p;
+	unsigned int count;
 
+	count = atomic_load_int(&sc->sc_count);
+	if (__predict_false(count == 0)) {
+		if_inc_counter(sc->sc_ifp, IFCOUNTER_OERRORS, 1);
+		m_freem(m);
+		return (ENETDOWN);
+	}
 	p = atomic_fetchadd_32(&sc->sc_seq, 1);
 	p /= sc->sc_stride;
-	p %= sc->sc_count;
-	lp = CK_SLIST_FIRST(&sc->sc_ports);
+	p %= count;
 
-	while (p--)
+	lp = CK_SLIST_FIRST(&sc->sc_ports);
+	while (p-- && lp != NULL)
 		lp = CK_SLIST_NEXT(lp, lp_entries);
 
 	/*
@@ -2614,13 +2613,20 @@ lagg_lb_start(struct lagg_softc *sc, struct mbuf *m)
 	struct lagg_lb *lb = (struct lagg_lb *)sc->sc_psc;
 	struct lagg_port *lp = NULL;
 	uint32_t p = 0;
+	unsigned int count;
 
+	count = atomic_load_int(&sc->sc_count);
+	if (__predict_false(count == 0)) {
+		if_inc_counter(sc->sc_ifp, IFCOUNTER_OERRORS, 1);
+		m_freem(m);
+		return (ENETDOWN);
+	}
 	if ((sc->sc_opts & LAGG_OPT_USE_FLOWID) &&
 	    M_HASHTYPE_GET(m) != M_HASHTYPE_NONE)
 		p = m->m_pkthdr.flowid >> sc->flowid_shift;
 	else
 		p = m_ether_tcpip_hash(sc->sc_flags, m, lb->lb_key);
-	p %= sc->sc_count;
+	p %= count;
 	lp = lb->lb_ports[p];
 
 	/*
home | help

Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?6a303e0f.1ddf3.5c2b70c>