This delta fixes two bugs:

  - When a vlan event occurs a check was not made that
    the event was actually for the interface, thus resulting
    in a panic. All three drivers have this vulnerability. Add
    a check for this condition.
  - Secondly, there was a duplicate buf_ring free in the em
    driver resulting in a panic on unload. Remove.

Approved by:  re

3 files changed, 25 insertions, 7 deletions

diff --git a/sys/dev/e1000/if_em.c b/sys/dev/e1000/if_em.c
index 8890297..35d5fcc 100644
--- a/sys/dev/e1000/if_em.c
+++ b/sys/dev/e1000/if_em.c
@@ -919,9 +919,6 @@ em_detach(device_t dev)
 	bus_generic_detach(dev);
 	if_free(ifp);
 
-#if __FreeBSD_version >= 800000
-	drbr_free(adapter->br, M_DEVBUF);
-#endif
 	em_free_transmit_structures(adapter);
 	em_free_receive_structures(adapter);
 
@@ -3644,7 +3641,8 @@ em_free_transmit_structures(struct adapter *adapter)
 		adapter->txtag = NULL;
 	}
 #if __FreeBSD_version >= 800000
-        buf_ring_free(adapter->br, M_DEVBUF);
+	if (adapter->br != NULL)
+        	buf_ring_free(adapter->br, M_DEVBUF);
 #endif
 }
 
@@ -4720,7 +4718,10 @@ em_register_vlan(void *unused, struct ifnet *ifp, u16 vtag)
 	struct adapter	*adapter = ifp->if_softc;
 	u32		index, bit;
 
-	if ((vtag == 0) || (vtag > 4095))       /* Invalid */
+	if (ifp->if_init !=  em_init)   /* Not our event */
+		return;
+
+	if ((vtag == 0) || (vtag > 4095))       /* Invalid ID */
                 return;
 
 	index = (vtag >> 5) & 0x7F;
@@ -4741,6 +4742,9 @@ em_unregister_vlan(void *unused, struct ifnet *ifp, u16 vtag)
 	struct adapter	*adapter = ifp->if_softc;
 	u32		index, bit;
 
+	if (ifp->if_init !=  em_init)
+		return;
+
 	if ((vtag == 0) || (vtag > 4095))       /* Invalid */
                 return;
 
diff --git a/sys/dev/e1000/if_igb.c b/sys/dev/e1000/if_igb.c
index 0ce17b7..143f6e2 100644
--- a/sys/dev/e1000/if_igb.c
+++ b/sys/dev/e1000/if_igb.c
@@ -3068,7 +3068,8 @@ igb_free_transmit_buffers(struct tx_ring *txr)
 		}
 	}
 #if __FreeBSD_version >= 800000
-	buf_ring_free(txr->br, M_DEVBUF);
+	if (txr->br != NULL)
+		buf_ring_free(txr->br, M_DEVBUF);
 #endif
 	if (txr->tx_buffers != NULL) {
 		free(txr->tx_buffers, M_DEVBUF);
@@ -4309,6 +4310,9 @@ igb_register_vlan(void *unused, struct ifnet *ifp, u16 vtag)
 	struct adapter	*adapter = ifp->if_softc;
 	u32		index, bit;
 
+	if (ifp->if_init !=  igb_init)   /* Not our event */
+		return;
+
 	if ((vtag == 0) || (vtag > 4095))       /* Invalid */
                 return;
 
@@ -4330,6 +4334,9 @@ igb_unregister_vlan(void *unused, struct ifnet *ifp, u16 vtag)
 	struct adapter	*adapter = ifp->if_softc;
 	u32		index, bit;
 
+	if (ifp->if_init !=  igb_init)
+		return;
+
 	if ((vtag == 0) || (vtag > 4095))       /* Invalid */
                 return;
 
diff --git a/sys/dev/ixgbe/ixgbe.c b/sys/dev/ixgbe/ixgbe.c
index fb8d6e5..6396769 100644
--- a/sys/dev/ixgbe/ixgbe.c
+++ b/sys/dev/ixgbe/ixgbe.c
@@ -2961,7 +2961,8 @@ ixgbe_free_transmit_buffers(struct tx_ring *txr)
 		}
 	}
 #if __FreeBSD_version >= 800000
-	buf_ring_free(txr->br, M_DEVBUF);
+	if (txr->br != NULL)
+		buf_ring_free(txr->br, M_DEVBUF);
 #endif
 	if (txr->tx_buffers != NULL) {
 		free(txr->tx_buffers, M_DEVBUF);
@@ -4128,6 +4129,9 @@ ixgbe_register_vlan(void *unused, struct ifnet *ifp, u16 vtag)
 	struct adapter	*adapter = ifp->if_softc;
 	u16		index, bit;
 
+	if (ifp->if_init !=  ixgbe_init)   /* Not our event */
+		return;
+
 	if ((vtag == 0) || (vtag > 4095))	/* Invalid */
 		return;
 
@@ -4150,6 +4154,9 @@ ixgbe_unregister_vlan(void *unused, struct ifnet *ifp, u16 vtag)
 	struct adapter	*adapter = ifp->if_softc;
 	u16		index, bit;
 
+	if (ifp->if_init !=  ixgbe_init)
+		return;
+
 	if ((vtag == 0) || (vtag > 4095))	/* Invalid */
 		return;