Change the reference counting to count the number of cloned interfaces for each

cloner. This ensures that ifc->ifc_units is not prematurely freed in
if_clone_detach() before the clones are destroyed, resulting in memory modified
after free. This could be triggered with if_vlan.

Assert that all cloners have been destroyed when freeing the memory.

Change all simple cloners to destroy their clones with ifc_simple_destroy() on
module unload so the reference count is properly updated. This also cleans up
the interface destroy routines and allows future optimisation.

Discussed with:	brooks, pjd, -current
Reviewed by:	brooks

1 files changed, 6 insertions, 14 deletions

diff --git a/sys/net/if_disc.c b/sys/net/if_disc.c
index d94eeeb..3b0804e 100644
--- a/sys/net/if_disc.c
+++ b/sys/net/if_disc.c
@@ -111,17 +111,6 @@ disc_clone_create(struct if_clone *ifc, int unit)
 }
 
 static void
-disc_destroy(struct disc_softc *sc)
-{
-
-	bpfdetach(sc->sc_ifp);
-	if_detach(sc->sc_ifp);
-	if_free(sc->sc_ifp);
-
-	free(sc, M_DISC);
-}
-
-static void
 disc_clone_destroy(struct ifnet *ifp)
 {
 	struct disc_softc	*sc;
@@ -131,7 +120,11 @@ disc_clone_destroy(struct ifnet *ifp)
 	LIST_REMOVE(sc, sc_list);
 	mtx_unlock(&disc_mtx);
 
-	disc_destroy(sc);
+	bpfdetach(ifp);
+	if_detach(ifp);
+	if_free(ifp);
+
+	free(sc, M_DISC);
 }
 
 static int
@@ -150,9 +143,8 @@ disc_modevent(module_t mod, int type, void *data)
 
 		mtx_lock(&disc_mtx);
 		while ((sc = LIST_FIRST(&disc_softc_list)) != NULL) {
-			LIST_REMOVE(sc, sc_list);
 			mtx_unlock(&disc_mtx);
-			disc_destroy(sc);
+			ifc_simple_destroy(&disc_cloner, sc->sc_ifp);
 			mtx_lock(&disc_mtx);
 		}
 		mtx_unlock(&disc_mtx);