diff options
| author | asomers <asomers@FreeBSD.org> | 2017-02-02 23:04:01 +0000 |
|---|---|---|
| committer | asomers <asomers@FreeBSD.org> | 2017-02-02 23:04:01 +0000 |
| commit | 440215ed1b031e19fb05ede7d1f9ee5efd2eec2f (patch) | |
| tree | 86d6ea5905e87323d8ce188dd43fc19eee968a1c /sys/net/if_lagg.c | |
| parent | cc500d084d5d3d5930ac536c10c970c18bc78b52 (diff) | |
| download | FreeBSD-src-440215ed1b031e19fb05ede7d1f9ee5efd2eec2f.zip FreeBSD-src-440215ed1b031e19fb05ede7d1f9ee5efd2eec2f.tar.gz | |
MFC r310180, r310327
r310180:
Fix panic during lagg destruction with simultaneous status check
If you run "ifconfig lagg0 destroy" and "ifconfig lagg0" at the same time a
page fault may result. The first process will destroy ifp->if_lagg in
lagg_clone_destroy (called by if_clone_destroy). Then the second process
will observe that ifp->if_lagg is NULL at the top of lagg_port_ioctl and
goto fallback: where it will promptly dereference ifp->if_lagg anyway.
The solution is to repeat the NULL check for ifp->if_lagg
MFC after: 4 weeks
Sponsored by: Spectra Logic Corp
Differential Revision: https://reviews.freebsd.org/D8512
r310327:
Remove stray debugging code from r310180
Reported by: rstone
Pointy hat to: asomers
MFC after: 3 weeks
X-MFC-with: 310180
Sponsored by: Spectra Logic Corp
Diffstat (limited to 'sys/net/if_lagg.c')
| -rw-r--r-- | sys/net/if_lagg.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sys/net/if_lagg.c b/sys/net/if_lagg.c index 87f358e..a892f8b 100644 --- a/sys/net/if_lagg.c +++ b/sys/net/if_lagg.c @@ -858,7 +858,7 @@ lagg_port_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data) return (error); fallback: - if (lp->lp_ioctl != NULL) + if (lp != NULL && lp->lp_ioctl != NULL) return ((*lp->lp_ioctl)(ifp, cmd, data)); return (EINVAL); |
