Make sure that we call if_free(ifp) after bus_teardown_intr. Since we

could get an interrupt after we free the ifp, and the interrupt
handler depended on the ifp being still alive, this could, in theory,
cause a crash.  Eliminate this possibility by moving the if_free to
after the bus_teardown_intr() call.

1 files changed, 1 insertions, 1 deletions

diff --git a/sys/dev/wl/if_wl.c b/sys/dev/wl/if_wl.c
index f34915f..0df46ca 100644
--- a/sys/dev/wl/if_wl.c
+++ b/sys/dev/wl/if_wl.c
@@ -589,7 +589,6 @@ wldetach(device_t device)
 
     ifp = sc->ifp;
     ether_ifdetach(ifp);
-    if_free(ifp);
 
     WL_LOCK(sc);
 
@@ -607,6 +606,7 @@ wldetach(device_t device)
     bus_generic_detach(device);
     wl_deallocate_resources(device);
     WL_UNLOCK(sc);
+    if_free(ifp);
     mtx_destroy(&sc->wl_mtx);
     return (0);
 }