Fix "struct ifnet" leaks when attach() fails in the middle.

9 files changed, 31 insertions, 16 deletions

diff --git a/sys/dev/bfe/if_bfe.c b/sys/dev/bfe/if_bfe.c
index 5d6309a..756bba0 100644
--- a/sys/dev/bfe/if_bfe.c
+++ b/sys/dev/bfe/if_bfe.c
@@ -427,11 +427,8 @@ bfe_attach(device_t dev)
 		goto fail;
 	}
 fail:
-	if(error) {
+	if (error)
 		bfe_release_resources(sc);
-		if (ifp != NULL)
-			if_free(ifp);
-	}
 	return (error);
 }
 
@@ -451,7 +448,6 @@ bfe_detach(device_t dev)
 	if (device_is_attached(dev)) {
 		bfe_stop(sc);
 		ether_ifdetach(ifp);
-		if_free(ifp);
 	}
 
 	bfe_chip_reset(sc);
@@ -939,6 +935,9 @@ bfe_release_resources(struct bfe_softc *sc)
 	if (sc->bfe_res != NULL)
 		bus_release_resource(dev, SYS_RES_MEMORY, 0x10, sc->bfe_res);
 
+	if (sc->bfe_ifp != NULL)
+		if_free(sc->bfe_ifp);
+
 	if(sc->bfe_tx_tag != NULL) {
 		bus_dmamap_unload(sc->bfe_tx_tag, sc->bfe_tx_map);
 		bus_dmamem_free(sc->bfe_tx_tag, sc->bfe_tx_list,
diff --git a/sys/dev/bge/if_bge.c b/sys/dev/bge/if_bge.c
index c4ae6b4..aac8095 100644
--- a/sys/dev/bge/if_bge.c
+++ b/sys/dev/bge/if_bge.c
@@ -2460,7 +2460,6 @@ bge_attach(dev)
 			printf("bge%d: MII without any PHY!\n", sc->bge_unit);
 			bge_release_resources(sc);
 			bge_free_jumbo_mem(sc);
-			if_free(ifp);
 			error = ENXIO;
 			goto fail;
 		}
@@ -2524,7 +2523,6 @@ bge_detach(dev)
 	BGE_UNLOCK(sc);
 
 	ether_ifdetach(ifp);
-	if_free(ifp);
 
 	if (sc->bge_tbi) {
 		ifmedia_removeall(&sc->bge_ifmedia);
@@ -2565,6 +2563,9 @@ bge_release_resources(sc)
 		bus_release_resource(dev, SYS_RES_MEMORY,
 		    BGE_PCI_BAR0, sc->bge_res);
 
+	if (sc->bge_ifp != NULL)
+		if_free(sc->bge_ifp);
+
 	bge_dma_free(sc);
 
 	if (mtx_initialized(&sc->bge_mtx))	/* XXX */
diff --git a/sys/dev/cnw/if_cnw.c b/sys/dev/cnw/if_cnw.c
index 900feb9..5db732d 100644
--- a/sys/dev/cnw/if_cnw.c
+++ b/sys/dev/cnw/if_cnw.c
@@ -1627,6 +1627,7 @@ static int cnw_pccard_attach(device_t dev)
 	error = cnw_alloc(dev);
 	if (error) {
 		device_printf(dev, "cnw_alloc() failed! (%d)\n", error);
+		if_free(ifp);
 		return (error);
 	}
 
@@ -1636,6 +1637,7 @@ static int cnw_pccard_attach(device_t dev)
 	if (error) {
 		device_printf(dev, "bus_setup_intr() failed! (%d)\n", error);
 		cnw_free(dev);
+		if_free(ifp);
 		return (error);
 	}
 
diff --git a/sys/dev/ed/if_ed.c b/sys/dev/ed/if_ed.c
index 41fc22e..1f60e132 100644
--- a/sys/dev/ed/if_ed.c
+++ b/sys/dev/ed/if_ed.c
@@ -252,6 +252,8 @@ ed_release_resources(device_t dev)
 		    sc->irq_rid, sc->irq_res);
 		sc->irq_res = 0;
 	}
+	if (sc->ifp)
+		if_free(sc->ifp);
 }
 
 /*
@@ -374,7 +376,6 @@ ed_detach(device_t dev)
 	ED_UNLOCK(sc);
 	callout_drain(&sc->tick_ch);
 	ether_ifdetach(ifp);
-	if_free(ifp);
 	bus_teardown_intr(dev, sc->irq_res, sc->irq_handle);
 	ed_release_resources(dev);
 	ED_LOCK_DESTROY(sc);
diff --git a/sys/dev/en/if_en_pci.c b/sys/dev/en/if_en_pci.c
index 77724d4..bfff233 100644
--- a/sys/dev/en/if_en_pci.c
+++ b/sys/dev/en/if_en_pci.c
@@ -199,8 +199,11 @@ en_pci_attach(device_t dev)
 	sc = device_get_softc(dev);
 	scp = (struct en_pci_softc *)sc;
 	sc->ifp = if_alloc(IFT_ATM);
-	if (sc->ifp == NULL)
-		return (ENOSPC);
+	if (sc->ifp == NULL) {
+		device_printf(dev, "can not if_alloc()\n");
+		error = ENOSPC;
+		goto fail;
+	}
 
 	if_initname(sc->ifp, device_get_name(dev),
 	    device_get_unit(dev));
@@ -220,6 +223,7 @@ en_pci_attach(device_t dev)
 	    RF_ACTIVE);
 	if (scp->res == NULL) {
 		device_printf(dev, "could not map memory\n");
+		if_free(sc->ifp);
 		error = ENXIO;
 		goto fail;
 	}
@@ -237,6 +241,7 @@ en_pci_attach(device_t dev)
 	if (scp->irq == NULL) {
 		device_printf(dev, "could not map interrupt\n");
 		bus_release_resource(dev, SYS_RES_MEMORY, PCI_CBMA, scp->res);
+		if_free(sc->ifp);
 		error = ENXIO;
 		goto fail;
 	}
@@ -267,6 +272,7 @@ en_pci_attach(device_t dev)
 		bus_teardown_intr(dev, scp->irq, scp->ih);
 		bus_release_resource(dev, SYS_RES_IRQ, 0, scp->irq);
 		bus_release_resource(dev, SYS_RES_MEMORY, PCI_CBMA, scp->res);
+		if_free(sc->ifp);
 		goto fail;
 	}
 
@@ -283,6 +289,7 @@ en_pci_attach(device_t dev)
 		bus_release_resource(dev, SYS_RES_IRQ, 0, scp->irq);
 		bus_release_resource(dev, SYS_RES_MEMORY, PCI_CBMA, scp->res);
 		en_destroy(sc);
+		if_free(sc->ifp);
 		goto fail;
 	}
 
diff --git a/sys/dev/ex/if_ex.c b/sys/dev/ex/if_ex.c
index e3d4859..3c1296f 100644
--- a/sys/dev/ex/if_ex.c
+++ b/sys/dev/ex/if_ex.c
@@ -196,6 +196,9 @@ ex_release_resources(device_t dev)
 		sc->irq = NULL;
 	}
 
+	if (sc->ifp)
+		if_free(sc->ifp);
+
 	return;
 }
 
@@ -276,7 +279,6 @@ ex_detach(device_t dev)
 
         ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
 	ether_ifdetach(ifp);
-	if_free(ifp);
 
 	ex_release_resources(dev);
 
diff --git a/sys/dev/hatm/if_hatm.c b/sys/dev/hatm/if_hatm.c
index cd955ac..37263f5 100644
--- a/sys/dev/hatm/if_hatm.c
+++ b/sys/dev/hatm/if_hatm.c
@@ -497,6 +497,9 @@ hatm_destroy(struct hatm_softc *sc)
 	cv_destroy(&sc->cv_rcclose);
 	cv_destroy(&sc->vcc_cv);
 	mtx_destroy(&sc->mtx);
+
+	if (sc->ifp != NULL)
+		if_free(sc->ifp);
 }
 
 /*
@@ -1631,7 +1634,6 @@ hatm_detach(device_t dev)
 	mtx_unlock(&sc->mtx);
 
 	atm_ifdetach(sc->ifp);
-	if_free(sc->ifp);
 
 	hatm_destroy(sc);
 
@@ -1655,8 +1657,7 @@ hatm_attach(device_t dev)
 	ifp = sc->ifp = if_alloc(IFT_ATM);
 	if (ifp == NULL) {
 		device_printf(dev, "could not if_alloc()\n");
-		error = ENOSPC;
-		goto failed;
+		return (ENOSPC);
 	}
 
 	sc->dev = dev;
diff --git a/sys/dev/ie/if_ie.c b/sys/dev/ie/if_ie.c
index 4326f98..c3dcdee 100644
--- a/sys/dev/ie/if_ie.c
+++ b/sys/dev/ie/if_ie.c
@@ -1777,6 +1777,8 @@ ie_release_resources (device_t dev)
 	if (sc->mem_res)
 		bus_release_resource(dev, SYS_RES_MEMORY,
 				     sc->mem_rid, sc->mem_res);
+	if (sc->ifp)
+		if_free(sc->ifp);
 
 	return;
 }
@@ -1796,7 +1798,6 @@ ie_detach (device_t dev)
 	ie_stop(sc);
 	ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
 	ether_ifdetach(ifp);
-	if_free(ifp);
 	ie_release_resources(dev);
 
 	return (0);
diff --git a/sys/dev/vge/if_vge.c b/sys/dev/vge/if_vge.c
index c269c0f..60d8cdc 100644
--- a/sys/dev/vge/if_vge.c
+++ b/sys/dev/vge/if_vge.c
@@ -1122,8 +1122,9 @@ vge_detach(dev)
 		 */
 		ifp->if_flags &= ~IFF_UP;
 		ether_ifdetach(ifp);
-		if_free(ifp);
 	}
+	if (ifp)
+		if_free(ifp);
 	if (sc->vge_miibus)
 		device_delete_child(dev, sc->vge_miibus);
 	bus_generic_detach(dev);