NetBSD Problem Report #60734

From www@netbsd.org  Wed Sep 16 13:30:28 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits)
	 client-signature RSA-PSS (2048 bits))
	(Client CN "mail.netbsd.org", Issuer "YR1" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 900031A923C
	for <gnats-bugs@gnats.NetBSD.org>; Wed, 16 Sep 2026 13:30:28 +0000 (UTC)
Message-Id: <20260916133027.402BF1A923E@mollari.NetBSD.org>
Date: Wed, 16 Sep 2026 13:30:27 +0000 (UTC)
From: campbell+netbsd@mumble.net
Reply-To: campbell+netbsd@mumble.net
To: gnats-bugs@NetBSD.org
Subject: wg(4): missing membar in wg_update_endpoint_if_necessary
X-Send-Pr-Version: www-1.0
X-From4GNATS: "campbell+netbsd@mumble.net via gnats" <gnats-admin@NetBSD.org>

>Number:         60734
>Category:       kern
>Synopsis:       wg(4): missing membar in wg_update_endpoint_if_necessary
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          needs-pullups
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Sep 16 13:35:00 +0000 2026
>Closed-Date:    
>Last-Modified:  Wed Sep 16 13:55:41 +0000 2026
>Originator:     Taylor R Campbell
>Release:        current, 11, 10, ...
>Organization:
The NetWG Barrier, Inc.
>Environment:
>Description:

   2998 static void
   2999 wg_update_endpoint_if_necessary(struct wg_peer *wgp,
   3000     const struct sockaddr *src)
   3001 {
...
   3021 		if (atomic_swap_uint(&wgp->wgp_endpoint_changing, 1) == 0) {
   3022 			wg_change_endpoint(wgp, src);
   3023 		}
...
   3027 }
...
   3618 static void
   3619 wg_task_endpoint_changed(struct wg_softc *wg, struct wg_peer *wgp)
   3620 {
...
   3626 	if (atomic_load_relaxed(&wgp->wgp_endpoint_changing)) {
   3627 		pserialize_perform(wgp->wgp_psz);
   3628 		mutex_exit(wgp->wgp_lock);
   3629 		psref_target_destroy(&wgp->wgp_endpoint0->wgsa_psref,
   3630 		    wg_psref_class);
   3631 		psref_target_init(&wgp->wgp_endpoint0->wgsa_psref,
   3632 		    wg_psref_class);
   3633 		mutex_enter(wgp->wgp_lock);
   3634 		atomic_store_release(&wgp->wgp_endpoint_changing, 0);
   3635 	}
   3636 }

	https://nxr.NetBSD.org/xref/src/sys/net/if_wg.c?r=1.143#2998

	There's no atomic_load_acquire or membar_acquire matching
	atomic_store_release in wg_task_endpoint_changed.  Presumably
	we need the psref target destroy/init cycle to happen-before
	the next wg_change_endpoint, but without any matching barrier,
	this is not guaranteed.

	It's also unclear to me why wg_task_endpoint_changed checks
	wgp_endpoint_changing -- I think this can be an assertion.

>How-To-Repeat:

	1. code inspection

	2. run wg(4) with rapidly varying endpoints on non-TSO CPUs
	   like arm/powerpc/riscv

>Fix:

	1. Insert membar_acquire in wg_update_endpoint_if_necessary
	   between atomic_swap_uint and wg_change_endpoint.

	2. Add comments cross-referencing membar_acquire and
	   atomic_store_release.

	3. Consider changing

   3626 	if (atomic_load_relaxed(&wgp->wgp_endpoint_changing)) {

	   to an assertion instead.

>Release-Note:

>Audit-Trail:
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60734 CVS commit: src/sys/net
Date: Wed, 16 Sep 2026 13:51:57 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Wed Sep 16 13:51:57 UTC 2026

 Modified Files:
 	src/sys/net: if_wg.c

 Log Message:
 wg(4): Insert missing membar_acquire and xref comments.

 PR kern/60734: wg(4): missing membar in wg_update_endpoint_if_necessary


 To generate a diff of this commit:
 cvs rdiff -u -r1.143 -r1.144 src/sys/net/if_wg.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: open->needs-pullups
State-Changed-By: riastradh@NetBSD.org
State-Changed-When: Wed, 16 Sep 2026 13:55:41 +0000
State-Changed-Why:
fixed in HEAD, needs pullup-11, pullup-10


>Unformatted:

Home	PR Database Search