[Bug 289017] [lagg] A time-of-check to time-of-use (TOCTOU) race exists in the Link Aggregation (LAGG) network subsystem

[email protected] Mon, 15 Dec 2025 02:58:34 +0000

Newsgroups	gmane.os.freebsd.devel.net
Message-ID	<[email protected]/bugzilla/>

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=289017

--- Comment #10 from Gui-Dong Han <[email protected]> ---
(In reply to Gui-Dong Han from comment #7)

Given that the transmit path can continue into the protocol's start function
after lagg_proto_detach has executed (as evidenced by the crash above), and
considering that detach explicitly frees protocol resources, I believe
triggering a Use-After-Free (UAF) scenario is also highly probable with the
specific timing.

-- 
You are receiving this mail because:
You are the assignee for the bug.