kern/59684: if_link_state_change_work races with ioctls

[campbell+netbsd%mumble.net@localhost]

>Number:         59684
>Category:       kern
>Synopsis:       if_link_state_change_work races with ioctls
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Oct 02 13:20:00 +0000 2025
>Originator:     Taylor R Campbell
>Release:        10, 9
>Organization:
The LinkBStateD Changes, Inc.
>Environment:
>Description:

	This change is probably worth applying to 10 and maybe 9:

changeset:   1193260:ddbace8c17df
branch:      trunk
user:        ozaki-r <ozaki-r%NetBSD.org@localhost>
date:        Thu Jun 12 10:23:43 2025 +0000
files:       sys/net/if.c
description:
if: protect if_link_state_change_process with IFNET_LOCK

This change avoids race conditions between if_link_state_change handlers
and other operations on a target interface such as if_ioctl.


diff -r a612b7bbc562 -r ddbace8c17df sys/net/if.c
--- a/sys/net/if.c	Thu Jun 12 08:27:40 2025 +0000
+++ b/sys/net/if.c	Thu Jun 12 10:23:43 2025 +0000
@@ -1,4 +1,4 @@
-/*	$NetBSD: if.c,v 1.534 2025/06/05 06:32:44 ozaki-r Exp $	*/
+/*	$NetBSD: if.c,v 1.535 2025/06/12 10:23:43 ozaki-r Exp $	*/
 
 /*-
  * Copyright (c) 1999, 2000, 2001, 2008 The NetBSD Foundation, Inc.
@@ -90,7 +90,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if.c,v 1.534 2025/06/05 06:32:44 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if.c,v 1.535 2025/06/12 10:23:43 ozaki-r Exp $");
 
 #if defined(_KERNEL_OPT)
 #include "opt_inet.h"
@@ -2418,7 +2418,9 @@ if_link_state_change_work(struct work *w
 	if (state == LINK_STATE_UNSET)
 		goto out;
 
+	IFNET_LOCK(ifp);
 	if_link_state_change_process(ifp, state);
+	IFNET_UNLOCK(ifp);
 
 	/* If there is a link state change to come, schedule it. */
 	IF_LINK_STATE_CHANGE_LOCK(ifp);


>How-To-Repeat:

	code inspection


>Fix:

	apply the change