Change the reference counting to count the number of cloned interfaces for each

cloner. This ensures that ifc->ifc_units is not prematurely freed in
if_clone_detach() before the clones are destroyed, resulting in memory modified
after free. This could be triggered with if_vlan.

Assert that all cloners have been destroyed when freeing the memory.

Change all simple cloners to destroy their clones with ifc_simple_destroy() on
module unload so the reference count is properly updated. This also cleans up
the interface destroy routines and allows future optimisation.

Discussed with:	brooks, pjd, -current
Reviewed by:	brooks

1 files changed, 1 insertions, 1 deletions

diff --git a/sys/contrib/pf/net/if_pfsync.c b/sys/contrib/pf/net/if_pfsync.c
index 971eea7..5f0e8a6 100644
--- a/sys/contrib/pf/net/if_pfsync.c
+++ b/sys/contrib/pf/net/if_pfsync.c
@@ -1852,7 +1852,7 @@ pfsync_modevent(module_t mod, int type, void *data)
 	case MOD_UNLOAD:
 		if_clone_detach(&pfsync_cloner);
 		while (!LIST_EMPTY(&pfsync_list))
-			pfsync_clone_destroy(
+			ifc_simple_destroy(&pfsync_cloner, 
 			    SCP2IFP(LIST_FIRST(&pfsync_list)));
 		break;