From: Jonathan Matthew <jonathan@d14n.org>
Subject: Re: Move copyout() out of netlock within sysctl_ifnames()
To: Vitaliy Makkoveev <mvs@openbsd.org>
Cc: Alexander Bluhm <bluhm@openbsd.org>, tech@openbsd.org
Date: Wed, 5 Nov 2025 17:45:38 +1000

On Tue, Nov 04, 2025 at 12:16:26PM +0300, Vitaliy Makkoveev wrote:
> Bump reference counter and link desired interface descriptors into
> temporary `if_tmplist' while holding shared netlock. This temporary
> list is protected by `if_tmplist_lock' rwlock so release of the
> netlock is fine. Do copyout() while holding `if_tmplist_lock' and
> then tear down temporary list.
> 
> We follow this way in if_getgroupmembers() and related paths.

This skips the tail of sysctl_rtable(), which is required for callers to
determine how much space is required.  This breaks dhcpleased and
probably more.

This gets things working again:

Index: rtsock.c
===================================================================
RCS file: /cvs/src/sys/net/rtsock.c,v
diff -u -p -r1.389 rtsock.c
--- rtsock.c	4 Nov 2025 20:03:03 -0000	1.389
+++ rtsock.c	5 Nov 2025 07:37:03 -0000
@@ -2276,7 +2276,8 @@ sysctl_rtable(int *name, u_int namelen, 
 		break;
 
 	case NET_RT_IFNAMES:
-		return (sysctl_ifnames(&w));
+		error = sysctl_ifnames(&w);
+		break;
 	}
 	free(w.w_tmem, M_RTABLE, w.w_tmemsize);
 	if (where) {