From 5937e1cdc99180b4adae2cf20cabd75dd9f45546 Mon Sep 17 00:00:00 2001 From: Gleb Smirnoff Date: Wed, 4 Feb 2026 14:07:11 -0800 Subject: [PATCH] bpf: don't clear pointer from descriptor to the tap on descriptor close During packet processing the descriptor is looked up using epoch(9) and it can be accessed after bpf_detachd(). In scenario of descriptor close the tap point is alive (it actually produces packets) and thus the pointer can be legitimately dereferenced. This fixes a race on a bpf(4) device close that would otherwise result in panic. Differential Revision: https://reviews.freebsd.org/D55064 --- sys/net/bpf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/net/bpf.c b/sys/net/bpf.c index 9f0b57728e8..228ac9867bd 100644 --- a/sys/net/bpf.c +++ b/sys/net/bpf.c @@ -678,8 +678,8 @@ bpf_detachd(struct bpf_d *d, bool detached_ifp) BPFD_LOCK(d); CK_LIST_REMOVE(d, bd_next); writer = (d->bd_writer > 0); - d->bd_bif = NULL; if (detached_ifp) { + d->bd_bif = NULL; /* * Notify descriptor as it's detached, so that any * sleepers wake up and get ENXIO.