The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=6de818285f066c6705816674c671761dc09bff90
commit 6de818285f066c6705816674c671761dc09bff90 Author: Mark Johnston <[email protected]> AuthorDate: 2026-08-07 14:47:06 +0000 Commit: Mark Johnston <[email protected]> CommitDate: 2026-08-07 16:30:24 +0000 netmap: Fix a race in kqueue registration We need to acquire the netmap global lock earlier, to avoid racing with the NETMAP_REQ_REGISTER ioctl handler. Reported by: syzkaller Reviewed by: vmaffione MFC after: 2 weeks Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D58677 --- sys/dev/netmap/netmap_freebsd.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/sys/dev/netmap/netmap_freebsd.c b/sys/dev/netmap/netmap_freebsd.c index 2241bfc970a6..409b273e6442 100644 --- a/sys/dev/netmap/netmap_freebsd.c +++ b/sys/dev/netmap/netmap_freebsd.c @@ -1452,24 +1452,24 @@ netmap_kqfilter(struct cdev *dev, struct knote *kn) if (ev != EVFILT_READ && ev != EVFILT_WRITE) { nm_prerr("bad filter request %d", ev); - return 1; + return EINVAL; } error = devfs_get_cdevpriv((void**)&priv); if (error) { nm_prerr("device not yet setup"); - return 1; + return error; } + NMG_LOCK(); na = priv->np_na; if (na == NULL) { + NMG_UNLOCK(); nm_prerr("no netmap adapter for this file descriptor"); - return 1; + return ENOENT; } /* the si is indicated in the priv */ si = priv->np_si[(ev == EVFILT_WRITE) ? NR_TX : NR_RX]; - kn->kn_fop = (ev == EVFILT_WRITE) ? - &netmap_wfiltops : &netmap_rfiltops; + kn->kn_fop = (ev == EVFILT_WRITE) ? &netmap_wfiltops : &netmap_rfiltops; kn->kn_hook = priv; - NMG_LOCK(); si->kqueue_users++; nm_prinf("kqueue users for %s: %d", si->mtxname, si->kqueue_users); NMG_UNLOCK();
