https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=279653
--- Comment #22 from [email protected] --- A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=f3de667137e90679cd20fa5c1dcd93a4c51ad848 commit f3de667137e90679cd20fa5c1dcd93a4c51ad848 Author: Gleb Smirnoff <[email protected]> AuthorDate: 2026-01-23 22:18:18 +0000 Commit: Gleb Smirnoff <[email protected]> CommitDate: 2026-01-23 22:18:18 +0000 netinet6: free in6_ifextra with epoch_call(9) This is expected to fix the old in6_selecthlim() panics. The nature of the panic is that a packet sending thread will obtain the struct ifnet pointer locklessly and then pick the if_inet6 pointer from it and dereference it. While the struct ifnet is freed via epoch_call(9), the struct in6_ifextra until this change was not. For the forwarded packets, or locally originated non-TCP packets we were probably safe due to the old if_dead trick. But locally originated TCP packets may dereference in6_ifextra via direct call into in6_selecthlim() from the tcp_output(), before ip6_output(). NB: hypothetically a similar problem also applies to IPv4's if_inet pointer, but there are no known panics, yet. PR: 279653 Reviewed by: tuexen Differential Revision: https://reviews.freebsd.org/D54728 sys/netinet6/in6_ifattach.c | 25 ++++++++++++++++++++----- sys/netinet6/in6_var.h | 2 ++ 2 files changed, 22 insertions(+), 5 deletions(-) -- You are receiving this mail because: You are the assignee for the bug.
