The branch stable/14 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=6420ead539ddcc7026933888665b7e4f5f0eb9cd
commit 6420ead539ddcc7026933888665b7e4f5f0eb9cd Author: Mark Johnston <[email protected]> AuthorDate: 2026-08-07 14:47:06 +0000 Commit: Mark Johnston <[email protected]> CommitDate: 2026-08-24 18:48:15 +0000 netmap: Fix a race in kqueue registration We need to acquire the netmap global lock earlier, to avoid racing with the NETMAP_REQ_REGISTER ioctl handler. Reported by: syzkaller Reviewed by: vmaffione MFC after: 2 weeks Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D58677 (cherry picked from commit 6de818285f066c6705816674c671761dc09bff90) --- sys/dev/netmap/netmap_freebsd.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/sys/dev/netmap/netmap_freebsd.c b/sys/dev/netmap/netmap_freebsd.c index 4c3aa5be0cce..615801acdd5e 100644 --- a/sys/dev/netmap/netmap_freebsd.c +++ b/sys/dev/netmap/netmap_freebsd.c @@ -1428,24 +1428,24 @@ netmap_kqfilter(struct cdev *dev, struct knote *kn) if (ev != EVFILT_READ && ev != EVFILT_WRITE) { nm_prerr("bad filter request %d", ev); - return 1; + return EINVAL; } error = devfs_get_cdevpriv((void**)&priv); if (error) { nm_prerr("device not yet setup"); - return 1; + return error; } + NMG_LOCK(); na = priv->np_na; if (na == NULL) { + NMG_UNLOCK(); nm_prerr("no netmap adapter for this file descriptor"); - return 1; + return ENOENT; } /* the si is indicated in the priv */ si = priv->np_si[(ev == EVFILT_WRITE) ? NR_TX : NR_RX]; - kn->kn_fop = (ev == EVFILT_WRITE) ? - &netmap_wfiltops : &netmap_rfiltops; + kn->kn_fop = (ev == EVFILT_WRITE) ? &netmap_wfiltops : &netmap_rfiltops; kn->kn_hook = priv; - NMG_LOCK(); si->kqueue_users++; nm_prinf("kqueue users for %s: %d", si->mtxname, si->kqueue_users); NMG_UNLOCK();
