Bug 202691 - race condition in if_lagg.c
Summary: race condition in if_lagg.c
Status: New
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: CURRENT
Hardware: Any Any
: --- Affects Many People
Assignee: freebsd-net (Nobody)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-08-27 12:11 UTC by yizhouzhou
Modified: 2018-12-19 00:39 UTC (History)
3 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description yizhouzhou 2015-08-27 12:11:38 UTC 
by examine the lock mechanism in if_lagg.c, I find race conditions as follows:

in function lagg_port_destroy: 
890         ifp->if_lagg = NULL;
is protected by rm_wlock on its sc

while in function lagg_input:
1656         struct lagg_port *lp = ifp->if_lagg;
1657         struct lagg_softc *sc = lp->lp_softc;
is not protected by any locks.


possible fixed:
replace the locks in if_lagg.c with a global rmlock
and check the value of ifp->if_lagg in lagg_input
to be not null after read locked




Many thanks
Zhouyi