[src/netbsd-8]: src/sys/net Pull up following revision(s) (requested by ozaki...

[martin <martin%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/5b06d682b725
branches:  netbsd-8
changeset: 376331:5b06d682b725
user:      martin <martin%NetBSD.org@localhost>
date:      Thu Jun 08 11:19:05 2023 +0000

description:
Pull up following revision(s) (requested by ozaki-r in ticket #1824):

        sys/net/route.c: revision 1.237

route: run workqueue kthreads with KERNEL_LOCK unless NET_MPSAFE

Without KERNEL_LOCK, rt_timer_work and rt_free_work can run in parallel
with other LWPs running in the network stack, which eventually results
in say use-after-free of a deleted route.

diffstat:

 sys/net/route.c |  10 ++++++----
 1 files changed, 6 insertions(+), 4 deletions(-)

diffs (51 lines):

diff -r 85550c992b4f -r 5b06d682b725 sys/net/route.c
--- a/sys/net/route.c   Sat Jun 03 15:10:56 2023 +0000
+++ b/sys/net/route.c   Thu Jun 08 11:19:05 2023 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: route.c,v 1.194.6.16 2023/02/22 18:55:06 martin Exp $  */
+/*     $NetBSD: route.c,v 1.194.6.17 2023/06/08 11:19:05 martin Exp $  */
 
 /*-
  * Copyright (c) 1998, 2008 The NetBSD Foundation, Inc.
@@ -97,7 +97,7 @@
 #endif
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: route.c,v 1.194.6.16 2023/02/22 18:55:06 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: route.c,v 1.194.6.17 2023/06/08 11:19:05 martin Exp $");
 
 #include <sys/param.h>
 #ifdef RTFLUSH_DEBUG
@@ -229,12 +229,14 @@ static krwlock_t          rt_lock __cacheline_al
 #define RT_UNLOCK()            rw_exit(&rt_lock)
 #define RT_WLOCKED()           rw_write_held(&rt_lock)
 #define        RT_ASSERT_WLOCK()       KASSERT(rw_write_held(&rt_lock))
+#define RT_WQ_FLAGS            WQ_MPSAFE
 #else
 #define RT_RLOCK()             do {} while (0)
 #define RT_WLOCK()             do {} while (0)
 #define RT_UNLOCK()            do {} while (0)
 #define RT_WLOCKED()           true
 #define        RT_ASSERT_WLOCK()       do {} while (0)
+#define RT_WQ_FLAGS            0
 #endif
 
 static uint64_t rtcache_generation;
@@ -479,7 +481,7 @@ rt_init(void)
        rt_psref_class = psref_class_create("rtentry", IPL_SOFTNET);
 
        error = workqueue_create(&rt_free_global.wq, "rt_free",
-           rt_free_work, NULL, PRI_SOFTNET, IPL_SOFTNET, WQ_MPSAFE);
+           rt_free_work, NULL, PRI_SOFTNET, IPL_SOFTNET, RT_WQ_FLAGS);
        if (error)
                panic("%s: workqueue_create failed (%d)\n", __func__, error);
 
@@ -1802,7 +1804,7 @@ rt_timer_init(void)
        LIST_INIT(&rttimer_queue_head);
        callout_init(&rt_timer_ch, CALLOUT_MPSAFE);
        error = workqueue_create(&rt_timer_wq, "rt_timer",
-           rt_timer_work, NULL, PRI_SOFTNET, IPL_SOFTNET, WQ_MPSAFE);
+           rt_timer_work, NULL, PRI_SOFTNET, IPL_SOFTNET, RT_WQ_FLAGS);
        if (error)
                panic("%s: workqueue_create failed (%d)\n", __func__, error);
        callout_reset(&rt_timer_ch, hz, rt_timer_timer, NULL);