kern/58520: experimental wg(4) lacks barriers around access to packet pending initiation

[campbell+netbsd%mumble.net@localhost]

>Number:         58520
>Category:       kern
>Synopsis:       experimental wg(4) lacks barriers around access to packet pending initiation
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Jul 29 19:00:03 +0000 2024
>Originator:     Taylor R Campbell
>Release:        current, 10
>Organization:
The NetWG Pendingmemoryation
>Environment:
>Description:
When there's no established session, wg_output stashes the packet the caller is trying to transmit in a single-entry queue before initiating a session:

   4241 		/*
   4242 		 * No established session.  If we're the first to try
   4243 		 * sending data, schedule a handshake and queue the
   4244 		 * packet for when the handshake is done; otherwise
   4245 		 * just drop the packet and let the ongoing handshake
   4246 		 * attempt continue.  We could queue more data packets
   4247 		 * but it's not clear that's worthwhile.
   4248 		 */
   4249 		if ((m = atomic_swap_ptr(&wgp->wgp_pending, m)) == NULL) {
   4250 			WG_TRACE("queued first packet; init handshake");
   4251 			wg_schedule_peer_task(wgp, WGP_TASK_SEND_INIT_MESSAGE);
https://nxr.netbsd.org/xref/src/sys/net/if_wg.c?r=1.122#4241

That way, once the session is established, the queued packet can be transmitted right away:

   2075 	/*
   2076 	 * If we had a data packet queued up, send it.
   2077 	 *
   2078 	 * If not, but we're the initiator, send a keepalive message --
   2079 	 * if we're the initiator we have to send something immediately
   2080 	 * or else the responder will never answer.
   2081 	 */
   2082 	if ((m = atomic_swap_ptr(&wgp->wgp_pending, NULL)) != NULL) {
   2083 		kpreempt_disable();
   2084 		const uint32_t h = curcpu()->ci_index; // pktq_rps_hash(m)
   2085 		M_SETCTX(m, wgp);
   2086 		if (__predict_false(!pktq_enqueue(wg_pktq, m, h))) {
   2087 			WGLOG(LOG_ERR, "%s: pktq full, dropping\n",
   2088 			    if_name(&wg->wg_if));
   2089 			m_freem(m);
   2090 		}
   2091 		kpreempt_enable();
https://nxr.netbsd.org/xref/src/sys/net/if_wg.c?r=1.122#2075

However, nothing guarantees the initialization of m in the caller of wg_output happens-before the use of m to transmit it.
>How-To-Repeat:
code inspection
>Fix:
membar_release and membar_acquire