Change the reference counting to count the number of cloned interfaces for each

cloner. This ensures that ifc->ifc_units is not prematurely freed in
if_clone_detach() before the clones are destroyed, resulting in memory modified
after free. This could be triggered with if_vlan.

Assert that all cloners have been destroyed when freeing the memory.

Change all simple cloners to destroy their clones with ifc_simple_destroy() on
module unload so the reference count is properly updated. This also cleans up
the interface destroy routines and allows future optimisation.

Discussed with:	brooks, pjd, -current
Reviewed by:	brooks

1 files changed, 10 insertions, 17 deletions

diff --git a/sys/net/if_gre.c b/sys/net/if_gre.c
index aa57526..20a5b90 100644
--- a/sys/net/if_gre.c
+++ b/sys/net/if_gre.c
@@ -202,20 +202,6 @@ gre_clone_create(ifc, unit)
 }
 
 static void
-gre_destroy(struct gre_softc *sc)
-{
-
-#ifdef INET
-	if (sc->encap != NULL)
-		encap_detach(sc->encap);
-#endif
-	bpfdetach(GRE2IFP(sc));
-	if_detach(GRE2IFP(sc));
-	if_free(GRE2IFP(sc));
-	free(sc, M_GRE);
-}
-
-static void
 gre_clone_destroy(ifp)
 	struct ifnet *ifp;
 {
@@ -224,7 +210,15 @@ gre_clone_destroy(ifp)
 	mtx_lock(&gre_mtx);
 	LIST_REMOVE(sc, sc_list);
 	mtx_unlock(&gre_mtx);
-	gre_destroy(sc);
+
+#ifdef INET
+	if (sc->encap != NULL)
+		encap_detach(sc->encap);
+#endif
+	bpfdetach(ifp);
+	if_detach(ifp);
+	if_free(ifp);
+	free(sc, M_GRE);
 }
 
 /*
@@ -791,9 +785,8 @@ gremodevent(module_t mod, int type, void *data)
 
 		mtx_lock(&gre_mtx);
 		while ((sc = LIST_FIRST(&gre_softc_list)) != NULL) {
-			LIST_REMOVE(sc, sc_list);
 			mtx_unlock(&gre_mtx);
-			gre_destroy(sc);
+			ifc_simple_destroy(&gre_cloner, GRE2IFP(sc));
 			mtx_lock(&gre_mtx);
 		}
 		mtx_unlock(&gre_mtx);