Fix "struct ifnet" leaks when attach() fails in the middle, e.g.

when mii_phy_probe() or bus_setup_intr() fails.  For drivers that
call their detach() in this case, call if_free() there to cover
this case too.

5 files changed, 10 insertions, 11 deletions

diff --git a/sys/dev/dc/if_dc.c b/sys/dev/dc/if_dc.c
index 1dab374..8a9e8c6 100644
--- a/sys/dev/dc/if_dc.c
+++ b/sys/dev/dc/if_dc.c
@@ -2310,7 +2310,6 @@ dc_attach(device_t dev)
 	if (error) {
 		device_printf(dev, "couldn't set up irq\n");
 		ether_ifdetach(ifp);
-		if_free(ifp);
 		goto fail;
 	}
 
@@ -2347,8 +2346,9 @@ dc_detach(device_t dev)
 		DC_UNLOCK(sc);
 		callout_drain(&sc->dc_stat_ch);
 		ether_ifdetach(ifp);
-		if_free(ifp);
 	}
+	if (ifp)
+		if_free(ifp);
 	if (sc->dc_miibus)
 		device_delete_child(dev, sc->dc_miibus);
 	bus_generic_detach(dev);
diff --git a/sys/dev/sf/if_sf.c b/sys/dev/sf/if_sf.c
index e14ce26..fa7eb83 100644
--- a/sys/dev/sf/if_sf.c
+++ b/sys/dev/sf/if_sf.c
@@ -766,7 +766,6 @@ sf_attach(dev)
 	if (error) {
 		device_printf(dev, "couldn't set up irq\n");
 		ether_ifdetach(ifp);
-		if_free(ifp);
 		goto fail;
 	}
 
@@ -802,8 +801,9 @@ sf_detach(dev)
 		SF_UNLOCK(sc);
 		callout_drain(&sc->sf_stat_callout);
 		ether_ifdetach(ifp);
-		if_free(ifp);
 	}
+	if (ifp)
+		if_free(ifp);
 	if (sc->sf_miibus)
 		device_delete_child(dev, sc->sf_miibus);
 	bus_generic_detach(dev);
diff --git a/sys/dev/sk/if_sk.c b/sys/dev/sk/if_sk.c
index b0d937a..6ae2352 100644
--- a/sys/dev/sk/if_sk.c
+++ b/sys/dev/sk/if_sk.c
@@ -1534,7 +1534,6 @@ sk_attach(dev)
 		    sc->sk_unit, sc_if->sk_phytype);
 		error = ENODEV;
 		SK_UNLOCK(sc);
-		if_free(ifp);
 		goto fail;
 	}
 
@@ -1565,7 +1564,6 @@ sk_attach(dev)
 	    sk_ifmedia_upd, sk_ifmedia_sts)) {
 		printf("skc%d: no PHY found!\n", sc_if->sk_unit);
 		ether_ifdetach(ifp);
-		if_free(ifp);
 		error = ENXIO;
 		goto fail;
 	}
@@ -1922,9 +1920,10 @@ sk_detach(dev)
 		/* Can't hold locks while calling detach */
 		SK_IF_UNLOCK(sc_if);
 		ether_ifdetach(ifp);
-		if_free(ifp);
 		SK_IF_LOCK(sc_if);
 	}
+	if (ifp)
+		if_free(ifp);
 	/*
 	 * We're generally called from skc_detach() which is using
 	 * device_delete_child() to get to here. It's already trashed
diff --git a/sys/dev/ti/if_ti.c b/sys/dev/ti/if_ti.c
index bef01ae..a6126df 100644
--- a/sys/dev/ti/if_ti.c
+++ b/sys/dev/ti/if_ti.c
@@ -2292,7 +2292,6 @@ ti_attach(dev)
 	if (error) {
 		printf("ti%d: couldn't set up irq\n", unit);
 		ether_ifdetach(ifp);
-		if_free(ifp);
 		goto fail;
 	}
 
@@ -2328,9 +2327,10 @@ ti_detach(dev)
 	if (device_is_attached(dev)) {
 		ti_stop(sc);
 		ether_ifdetach(ifp);
-		if_free(ifp);
 		bus_generic_detach(dev);
 	}
+	if (ifp)
+		if_free(ifp);
 	ifmedia_removeall(&sc->ifmedia);
 
 	if (sc->ti_rdata)
diff --git a/sys/dev/vr/if_vr.c b/sys/dev/vr/if_vr.c
index 340aac7..5eabc21 100644
--- a/sys/dev/vr/if_vr.c
+++ b/sys/dev/vr/if_vr.c
@@ -769,7 +769,6 @@ vr_attach(dev)
 	if (error) {
 		printf("vr%d: couldn't set up irq\n", unit);
 		ether_ifdetach(ifp);
-		if_free(ifp);
 		goto fail;
 	}
 
@@ -804,9 +803,10 @@ vr_detach(device_t dev)
 		vr_stop(sc);
 		VR_UNLOCK(sc);		/* XXX: Avoid recursive acquire. */
 		ether_ifdetach(ifp);
-		if_free(ifp);
 		VR_LOCK(sc);
 	}
+	if (ifp)
+		if_free(ifp);
 	if (sc->vr_miibus)
 		device_delete_child(dev, sc->vr_miibus);
 	bus_generic_detach(dev);