The advent of if_detach, allowing interface removal at runtime, makes it

possible for a panic to occur if BPF is in use on the interface at the
time of the call to if_detach.  This happens because BPF maintains pointers
to the struct ifnet describing the interface, which is freed by if_detach.

To correct this problem, a new call, bpfdetach, is introduced.  bpfdetach
locates BPF descriptor references to the interface, and NULLs them.  Other
BPF code is modified so that discovery of a NULL interface results in
ENXIO (already implemented for some calls).  Processes blocked on a BPF
call will also be woken up so that they can receive ENXIO.

Interface drivers that invoke bpfattach and if_detach must be modified to
also call bpfattach(ifp) before calling if_detach(ifp).  This is relevant
for buses that support hot removal, such as pccard and usb.  Patches to
all effected devices will not be committed, only to if_wi.c, due to
testing limitations.  To reproduce the crash, load up tcpdump on you
favorite pccard ethernet card, and then eject the card.  As some pccard
drivers do not invoke if_detach(ifp), this bug will not manifest itself
for those drivers.

Reviewed by:	wes

1 files changed, 2 insertions, 0 deletions

diff --git a/sys/net/bpf.h b/sys/net/bpf.h
index 9494e83..a173b0a 100644
--- a/sys/net/bpf.h
+++ b/sys/net/bpf.h
@@ -232,6 +232,8 @@ int	 bpf_validate __P((const struct bpf_insn *, int));
 void	 bpf_tap __P((struct ifnet *, u_char *, u_int));
 void	 bpf_mtap __P((struct ifnet *, struct mbuf *));
 void	 bpfattach __P((struct ifnet *, u_int, u_int));
+void	 bpfdetach __P((struct ifnet *));
+
 void	 bpfilterattach __P((int));
 u_int	 bpf_filter __P((const struct bpf_insn *, u_char *, u_int, u_int));
 #endif