diff options
| author | kensmith <kensmith@FreeBSD.org> | 2005-09-08 13:50:16 +0000 |
|---|---|---|
| committer | kensmith <kensmith@FreeBSD.org> | 2005-09-08 13:50:16 +0000 |
| commit | d937ab24bb229535b0083dd2c37bca67f4ec2cea (patch) | |
| tree | a6226248e2d2459c0791b1a073ae04ba2e63abb7 /sys/dev/hme | |
| parent | 3101512780692cfa6bb394a8cf679cce5fdfc565 (diff) | |
| download | FreeBSD-src-d937ab24bb229535b0083dd2c37bca67f4ec2cea.zip FreeBSD-src-d937ab24bb229535b0083dd2c37bca67f4ec2cea.tar.gz | |
Move hme_stop() after ether_ifdetach() and if_free() to prevent a
memory-referenced-after-free panic if the hme interface fails to
attach.
Patch obtained from: marius
Suggested same thing: brooks
MFC after: 3 days
Diffstat (limited to 'sys/dev/hme')
| -rw-r--r-- | sys/dev/hme/if_hme.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sys/dev/hme/if_hme.c b/sys/dev/hme/if_hme.c index 80237b3..2d90a13 100644 --- a/sys/dev/hme/if_hme.c +++ b/sys/dev/hme/if_hme.c @@ -380,12 +380,12 @@ hme_detach(struct hme_softc *sc) struct ifnet *ifp = sc->sc_ifp; int i; - ether_ifdetach(ifp); - if_free(ifp); HME_LOCK(sc); hme_stop(sc); HME_UNLOCK(sc); callout_drain(&sc->sc_tick_ch); + ether_ifdetach(ifp); + if_free(ifp); device_delete_child(sc->sc_dev, sc->sc_miibus); for (i = 0; i < HME_NTXQ; i++) { |
