d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
16d878cc99
freebsd-dev/sys/dev
History
Christian S.J. Peron 16d878cc99 Fix the following bpf(4) race condition which can result in a panic: 
(1) bpf peer attaches to interface netif0
	(2) Packet is received by netif0
	(3) ifp->if_bpf pointer is checked and handed off to bpf
	(4) bpf peer detaches from netif0 resulting in ifp->if_bpf being
	    initialized to NULL.
	(5) ifp->if_bpf is dereferenced by bpf machinery
	(6) Kaboom

This race condition likely explains the various different kernel panics
reported around sending SIGINT to tcpdump or dhclient processes. But really
this race can result in kernel panics anywhere you have frequent bpf attach
and detach operations with high packet per second load.

Summary of changes:

- Remove the bpf interface's "driverp" member
- When we attach bpf interfaces, we now set the ifp->if_bpf member to the
  bpf interface structure. Once this is done, ifp->if_bpf should never be
  NULL. [1]
- Introduce bpf_peers_present function, an inline operation which will do
  a lockless read bpf peer list associated with the interface. It should
  be noted that the bpf code will pickup the bpf_interface lock before adding
  or removing bpf peers. This should serialize the access to the bpf descriptor
  list, removing the race.
- Expose the bpf_if structure in bpf.h so that the bpf_peers_present function
  can use it. This also removes the struct bpf_if; hack that was there.
- Adjust all consumers of the raw if_bpf structure to use bpf_peers_present

Now what happens is:

	(1) Packet is received by netif0
	(2) Check to see if bpf descriptor list is empty
	(3) Pickup the bpf interface lock
	(4) Hand packet off to process

From the attach/detach side:

	(1) Pickup the bpf interface lock
	(2) Add/remove from bpf descriptor list

Now that we are storing the bpf interface structure with the ifnet, there is
is no need to walk the bpf interface list to locate the correct bpf interface.
We now simply look up the interface, and initialize the pointer. This has a
nice side effect of changing a bpf interface attach operation from O(N) (where
N is the number of bpf interfaces), to O(1).

[1] From now on, we can no longer check ifp->if_bpf to tell us whether or
    not we have any bpf peers that might be interested in receiving packets.

In collaboration with:	sam@
MFC after:	1 month
2006-06-02 19:59:33 +00:00
..
aac Rearrange locking in the alloc_commands and ioctl paths to avoid problems. 2006-04-08 06:05:29 +00:00
acpi_support Add support for Asus W5A laptops. 2006-04-09 15:22:25 +00:00
acpica Since DELAY() was moved, most <machine/clock.h> #includes have been 2006-05-16 14:37:58 +00:00
adlink
advansys Remove some header polution. 2006-04-30 16:44:41 +00:00
agp Move SiS 760 to where it belongs. 2006-05-30 18:41:26 +00:00
aha Add explicit dependency on cam. This is necessary when both aha.ko and 2006-03-24 06:33:25 +00:00
ahb Fix missing update to reflect change in scsi_inquiry data structure. 2006-05-31 14:33:23 +00:00
aic
aic7xxx Since DELAY() was moved, most <machine/clock.h> #includes have been 2006-05-16 14:37:58 +00:00
amd
amr Make amr_linux work as a module by avoiding calling amr_linux_ioctl_int 2006-05-03 16:45:15 +00:00
an Since DELAY() was moved, most <machine/clock.h> #includes have been 2006-05-16 14:37:58 +00:00
ar - Use bus_setup_intr() and bus_teardown_intr() to register device driver 2006-02-22 18:16:26 +00:00
arcmsr Since DELAY() was moved, most <machine/clock.h> #includes have been 2006-05-16 14:37:58 +00:00
arl Since DELAY() was moved, most <machine/clock.h> #includes have been 2006-05-16 14:37:58 +00:00
asr Remove various bits of conditional Alpha code and fixup a few comments. 2006-05-12 05:04:46 +00:00
ata Remove various bits of conditional Alpha code and fixup a few comments. 2006-05-12 05:04:46 +00:00
ath Fix the following bpf(4) race condition which can result in a panic: 2006-06-02 19:59:33 +00:00
atkbdc Send the pcvt(4) driver off to retirement. 2006-05-17 09:33:15 +00:00
auxio - Only touch the LED bit of the (LED) AUXIO register when turning the 2006-01-26 19:04:18 +00:00
awi
bce Since DELAY() was moved, most <machine/clock.h> #includes have been 2006-05-16 14:37:58 +00:00
bfe Back out the BUS_DMA_ALLOCNOW change from rev 1.39. Scottl informed me that 2006-05-28 20:35:39 +00:00
bge Since DELAY() was moved, most <machine/clock.h> #includes have been 2006-05-16 14:37:58 +00:00
bktr don't require a buffer if all we are doing is manipulating the GPIO pins... 2006-05-26 07:36:50 +00:00
buslogic
cardbus Make the 'pci_devclass' pointer variable private (drivers really shouldn't 2006-01-20 22:00:50 +00:00
ce Update low-level code. (to version 1.4) 2006-03-01 09:50:20 +00:00
ciss Spin until a request structure is available in the ioctl path. 2006-05-30 06:42:02 +00:00
cm
cnw Since DELAY() was moved, most <machine/clock.h> #includes have been 2006-05-16 14:37:58 +00:00
cp trim trailing ^I 2005-12-17 07:09:17 +00:00
cpufreq Since DELAY() was moved, most <machine/clock.h> #includes have been 2006-05-16 14:37:58 +00:00
cs Fix multicast support for cs89x0 chips. Just setting the RX_MULTCAST_ACCEPT 2006-03-10 23:50:53 +00:00
ct Since DELAY() was moved, most <machine/clock.h> #includes have been 2006-05-16 14:37:58 +00:00
ctau Since DELAY() was moved, most <machine/clock.h> #includes have been 2006-05-16 14:37:58 +00:00
cx Since DELAY() was moved, most <machine/clock.h> #includes have been 2006-05-16 14:37:58 +00:00
cy Catch up with new interrupt handling code. 2005-10-26 06:44:59 +00:00
dc Remove various bits of conditional Alpha code and fixup a few comments. 2006-05-12 05:04:46 +00:00
dcons Convert to new console interface. 2006-05-26 13:51:38 +00:00
de Remove various bits of conditional Alpha code and fixup a few comments. 2006-05-12 05:04:46 +00:00
digi Only reference the firmware module once rather than twice. The extra call 2006-05-25 22:04:46 +00:00
dpt Since DELAY() was moved, most <machine/clock.h> #includes have been 2006-05-16 14:37:58 +00:00
drm Update to current DRM CVS, bringing in a fix for a NULL pointer chase when 2006-05-17 06:36:28 +00:00
ed Since DELAY() was moved, most <machine/clock.h> #includes have been 2006-05-16 14:37:58 +00:00
eisa
em Fix static array overrun. 2006-05-17 07:38:58 +00:00
en Subtracting two pointers produces a ptrdiff_t not a size_t so use 2006-03-21 15:00:10 +00:00
ep Remove ifdef notdef SIOCHWADDR vestige. 2006-02-04 08:16:07 +00:00
esp Fix -Wundef from compiling the amd64 LINT. 2005-12-04 10:06:06 +00:00
ex Remove ifdef notyet SIOCGHWADDR vestige. 2006-02-04 08:16:41 +00:00
exca Don't dereference an uninitialized pointer. 2006-03-09 16:28:24 +00:00
fatm This driver has been MPSAFE from the beginning so declare the interrupt 2006-03-21 14:56:42 +00:00
fb Since DELAY() was moved, most <machine/clock.h> #includes have been 2006-05-16 14:37:58 +00:00
fdc - Use callout_init_mtx() to initialize toffhandle callout using the fdc's 2006-02-23 19:11:16 +00:00
fe Return 0 if we are a network card and do match. Previously, we'd bogusly 2005-11-19 23:26:57 +00:00
firewire Don't type pun accidentally. Instead, be explicit that we're type 2006-02-04 21:37:39 +00:00
fxp Since DELAY() was moved, most <machine/clock.h> #includes have been 2006-05-16 14:37:58 +00:00
gem Fix -Wundef warnings found when compiling i386 LINT, GENERIC and 2005-12-05 11:58:35 +00:00
gfb Since DELAY() was moved, most <machine/clock.h> #includes have been 2006-05-16 14:37:58 +00:00
harp
hatm
hfa
hifn Fix HMACs handling with uio's by not using crp_mac for storing calculated 2006-05-22 16:18:21 +00:00
hme Fix typo in printf string. 2006-05-27 09:28:59 +00:00
hptmv Since DELAY() was moved, most <machine/clock.h> #includes have been 2006-05-16 14:37:58 +00:00
hwpmc First pass at removing Alpha kernel support. 2006-05-11 22:25:28 +00:00
ic Allow uart(4)'s ns8250 driver to work with devices whose regshift is > 0. 2006-05-23 00:41:12 +00:00
ichsmb This signal handling code is worse than a no-op. If a 2006-01-03 17:01:43 +00:00
ichwd Re-work the bus attachment somewhat. Make the rids unique for 2006-02-17 18:46:18 +00:00
ida
idt Since DELAY() was moved, most <machine/clock.h> #includes have been 2006-05-16 14:37:58 +00:00
ie Since DELAY() was moved, most <machine/clock.h> #includes have been 2006-05-16 14:37:58 +00:00
ieee488 Don't be noisy in case of shared interrupts. 2006-03-11 15:39:22 +00:00
if_ndis When ndis_attach() runs, it has to very briefly initialize the card 2006-02-04 19:42:49 +00:00
iicbus remove DRIVER_MODULE lines that are useless... pcf doesn't exist (only 2006-04-17 22:33:42 +00:00
iir Since DELAY() was moved, most <machine/clock.h> #includes have been 2006-05-16 14:37:58 +00:00
io
ipmi Since DELAY() was moved, most <machine/clock.h> #includes have been 2006-05-16 14:37:58 +00:00
ips Since DELAY() was moved, most <machine/clock.h> #includes have been 2006-05-16 14:37:58 +00:00
ipw Fix the following bpf(4) race condition which can result in a panic: 2006-06-02 19:59:33 +00:00
isp Don't set CAM_DEV_QFRZN when we get an ABORT_TASK. Just 2006-05-30 17:43:04 +00:00
ispfw Update 2300 f/w. This will probably be the last 2006-04-18 21:55:30 +00:00
iwi Fix the following bpf(4) race condition which can result in a panic: 2006-06-02 19:59:33 +00:00
ixgb Since DELAY() was moved, most <machine/clock.h> #includes have been 2006-05-16 14:37:58 +00:00
joy Unbreak second joystick (joy1) support. 2005-11-09 20:26:00 +00:00
kbd Integrate kbdmux(4) into syscons(4) and kbd code. 2006-02-28 23:46:23 +00:00
kbdmux Fix endian bugs accessing ioctl arguments that are passed by value. 2006-03-03 00:46:28 +00:00
le - Fix the busname in the DRIVER_MODULE. 2006-05-22 13:43:36 +00:00
led
lge Since DELAY() was moved, most <machine/clock.h> #includes have been 2006-05-16 14:37:58 +00:00
lmc Since DELAY() was moved, most <machine/clock.h> #includes have been 2006-05-16 14:37:58 +00:00
mc146818
mca
mcd
md - Conditionally acquire Giant in mdstart_vnode(), mdcreate_vnode(), and 2006-03-28 21:25:11 +00:00
mem
mfi Add in a bunch of things to the mfi driver: 2006-05-18 23:30:48 +00:00
mii If the PHY has 1000BASE-T capability, check to see if a 1000BASE-T speed 2006-05-19 03:51:42 +00:00
mk48txx
mlx
mly
mpt Make the code able to compile again in RELENG_4. 2006-06-02 19:23:12 +00:00
mse Since DELAY() was moved, most <machine/clock.h> #includes have been 2006-05-16 14:37:58 +00:00
mxge Since DELAY() was moved, most <machine/clock.h> #includes have been 2006-05-16 14:37:58 +00:00
my Since DELAY() was moved, most <machine/clock.h> #includes have been 2006-05-16 14:37:58 +00:00
myri10ge Since DELAY() was moved, most <machine/clock.h> #includes have been 2006-05-16 14:37:58 +00:00
ncv Since DELAY() was moved, most <machine/clock.h> #includes have been 2006-05-16 14:37:58 +00:00
nge Since DELAY() was moved, most <machine/clock.h> #includes have been 2006-05-16 14:37:58 +00:00
nmdm Use ttyalloc() instead of ttymalloc() 2006-01-04 08:34:23 +00:00
nsp Since DELAY() was moved, most <machine/clock.h> #includes have been 2006-05-16 14:37:58 +00:00
null
nve ALTQ-ify nve(4). 2006-05-20 21:08:09 +00:00
ofw Fix various typos and brainos in last commit. 2006-05-30 07:56:57 +00:00
patm This driver has been MPSAFE from the beginning, so declare the interrupt 2006-03-21 14:54:42 +00:00
pbio Since DELAY() was moved, most <machine/clock.h> #includes have been 2006-05-16 14:37:58 +00:00
pccard replace all the 660 with 650 in the cut-n-pasted line, rather than 2006-05-08 22:59:33 +00:00
pccbb Zero out the devices when they are deleted. We can access the pointer after 2006-06-02 06:33:35 +00:00
pcf - Use bus_setup_intr() and bus_teardown_intr() to register device driver 2006-02-22 18:16:26 +00:00
pci Add a define for the Standard SD Host Controller Base Peripheral. 2006-05-30 21:36:12 +00:00
pdq Since DELAY() was moved, most <machine/clock.h> #includes have been 2006-05-16 14:37:58 +00:00
ppbus Since DELAY() was moved, most <machine/clock.h> #includes have been 2006-05-16 14:37:58 +00:00
ppc Remove various bits of conditional Alpha code and fixup a few comments. 2006-05-12 05:04:46 +00:00
pst
puc Rewrite of puc(4). Significant changes are: 2006-04-28 21:21:53 +00:00
ral Fix the following bpf(4) race condition which can result in a panic: 2006-06-02 19:59:33 +00:00
random Change msleep() and tsleep() to not alter the calling thread's priority 2006-04-17 18:20:38 +00:00
ray - Store pointer to the link-level address right in "struct ifnet" 2005-11-11 16:04:59 +00:00
rc - Use swi_remove() to teardown swi handlers rather than 2005-10-26 15:52:16 +00:00
re Rename device name in the last commit. According to PR, the ID is 2006-05-24 11:55:25 +00:00
rndtest
rp The UPCI 32 rp(4) card uses BAR 2 like the UPCI 80 card. 2006-01-25 14:55:11 +00:00
rr232x Make this compile with -Wundef. 2006-05-16 15:23:27 +00:00
safe Fix HMACs handling with uio's by not using crp_mac for storing calculated 2006-05-22 16:18:21 +00:00
sbni - Store pointer to the link-level address right in "struct ifnet" 2005-11-11 16:04:59 +00:00
sbsh Since DELAY() was moved, most <machine/clock.h> #includes have been 2006-05-16 14:37:58 +00:00
scc The Z8530 on the MacIO has an interrupt per channel. Deal with this 2006-04-04 17:33:08 +00:00
scd
sf Remove various bits of conditional Alpha code and fixup a few comments. 2006-05-12 05:04:46 +00:00
si - Update copyright years from the Specialix SDK. 2006-01-06 20:17:48 +00:00
sio Eliminate gdb_checkc member from GDB_DBGPORT(), it is never used. 2006-05-26 11:54:32 +00:00
sk Re-wrok PHY setup, media handling and dual-port detection. 2006-05-15 04:50:33 +00:00
smbus Drivers for AMD-8111 and NVIDIA nForce2/3/4 SMBus 2.0 controllers. 2005-12-21 15:49:51 +00:00
sn Fix mismerge after last cvs update for the IFQ_DRV_DEQUEUE changes. 2006-02-04 08:19:00 +00:00
snc Fix -Wundef warnings from compiling GENERIC and LINT kernels of 2005-12-06 11:19:37 +00:00
snp
sound Fix build with -Wundef. 2006-05-29 17:37:41 +00:00
speaker Add /dev/speaker support to amd64. 2005-11-11 09:57:32 +00:00
sr - Use bus_setup_intr() and bus_teardown_intr() to register device driver 2006-02-22 18:16:26 +00:00
stg Since DELAY() was moved, most <machine/clock.h> #includes have been 2006-05-16 14:37:58 +00:00
streams
sym Remove various bits of conditional Alpha code and fixup a few comments. 2006-05-12 05:04:46 +00:00
syscons Convert to new console api 2006-05-26 13:54:27 +00:00
tdfx Take the functionality contained in the former "options TDFX_LINUX" 2006-03-03 21:37:38 +00:00
ti - Tx side bus_dmamap_load_mbuf_sg(9) support. This reduces bookkeeping 2006-01-03 06:14:07 +00:00
trm Since DELAY() was moved, most <machine/clock.h> #includes have been 2006-05-16 14:37:58 +00:00
twa Remove header pollution. 2006-04-30 16:46:11 +00:00
twe Normalize a significant number of kernel malloc type names: 2005-10-31 15:41:29 +00:00
tx Since DELAY() was moved, most <machine/clock.h> #includes have been 2006-05-16 14:37:58 +00:00
txp Since DELAY() was moved, most <machine/clock.h> #includes have been 2006-05-16 14:37:58 +00:00
uart Convert to new console api 2006-05-26 13:54:27 +00:00
ubsec Forgot to remove the line. 2006-05-23 09:02:14 +00:00
usb Fix the following bpf(4) race condition which can result in a panic: 2006-06-02 19:59:33 +00:00
utopia
vge Do not touch ifp->if_baudrate in miibus aware drivers. 2006-02-14 12:44:56 +00:00
vkbd Disable custom locking in the vkbd(4) for now and make it rely on the 2006-02-27 06:17:48 +00:00
vr Remove various bits of conditional Alpha code and fixup a few comments. 2006-05-12 05:04:46 +00:00
vx - Store pointer to the link-level address right in "struct ifnet" 2005-11-11 16:04:59 +00:00
watchdog
wds Since DELAY() was moved, most <machine/clock.h> #includes have been 2006-05-16 14:37:58 +00:00
wi Fix the following bpf(4) race condition which can result in a panic: 2006-06-02 19:59:33 +00:00
wl - Store pointer to the link-level address right in "struct ifnet" 2005-11-11 16:04:59 +00:00
xe o Fix printf(9) formatting: do not use hardcode "0x" and "#" flags 2006-04-15 11:41:40 +00:00
zs Update to new console api. 2006-05-26 18:25:34 +00:00