HomeFreeBSD

lagg: Fix a teardown race

Description

lagg: Fix a teardown race

When a lagg interface is destroyed, it destroys all of the lagg ports,
which triggers an asynchronous link state change handler. This in turn
may generate a netlink message, a portion of which requires netlink to
invoke the SIOCGIFMEDIA ioctl of the lagg interface, which involves
scanning the list of interface media. This list is not internally
locked, it requires the interface driver to provide some kind of
synchronization.

Shortly after the link state notification has been raised, the lagg
interface detaches itself from the network stack. As a part of this, it
blocks in order to wait for link state handlers to drain, but before
that it destroys the interface media list. Reverse this order of
operations so that the link state change handlers drain first, avoiding
a use-after-free that is very occasionally triggered by lagg stress
tests. This matches other ethernet drivers in the tree.

MFC after: 2 weeks

Details

Provenance
markjAuthored on Jun 24 2024, 2:47 PM
Parents
rG66b8cac8d837: pf: Sprinkle const qualifiers in state lookup routines
Branches
Unknown
Tags
Unknown