Introduce lo_mtx to protect the global loopback softc list. I'm not

really sure why we have a softc list for if_loop, given that it
can't be unloaded, but that's an issue to revisit in the future as
corrupting the softc list would still cause panics.

Reviewed by:	benno

1 files changed, 7 insertions, 1 deletions

diff --git a/sys/net/if_loop.c b/sys/net/if_loop.c
index 38aae4e..1544b73 100644
--- a/sys/net/if_loop.c
+++ b/sys/net/if_loop.c
@@ -113,6 +113,7 @@ struct ifnet *loif = NULL;			/* Used externally */
 
 static MALLOC_DEFINE(M_LO, LONAME, "Loopback Interface");
 
+static struct mtx lo_mtx;
 static LIST_HEAD(lo_list, lo_softc) lo_list;
 
 struct if_clone lo_cloner = IF_CLONE_INITIALIZER(LONAME,
@@ -129,9 +130,11 @@ lo_clone_destroy(ifp)
 	/* XXX: destroying lo0 will lead to panics. */
 	KASSERT(loif != ifp, ("%s: destroying lo0", __func__));
 
+	mtx_lock(&lo_mtx);
+	LIST_REMOVE(sc, sc_next);
+	mtx_unlock(&lo_mtx);
 	bpfdetach(ifp);
 	if_detach(ifp);
-	LIST_REMOVE(sc, sc_next);
 	free(sc, M_LO);
 }
 
@@ -154,7 +157,9 @@ lo_clone_create(ifc, unit)
 	sc->sc_if.if_softc = sc;
 	if_attach(&sc->sc_if);
 	bpfattach(&sc->sc_if, DLT_NULL, sizeof(u_int));
+	mtx_lock(&lo_mtx);
 	LIST_INSERT_HEAD(&lo_list, sc, sc_next);
+	mtx_unlock(&lo_mtx);
 	if (loif == NULL)
 		loif = &sc->sc_if;
 
@@ -166,6 +171,7 @@ loop_modevent(module_t mod, int type, void *data)
 { 
 	switch (type) { 
 	case MOD_LOAD: 
+		mtx_init(&lo_mtx, "lo_mtx", NULL, MTX_DEF);
 		LIST_INIT(&lo_list);
 		if_clone_attach(&lo_cloner);
 		break;