Add ifunit_ref(), a version of ifunit(), that returns not just an

interface pointer, but also a reference to it.

Modify ifioctl() to use ifunit_ref(), holding the reference until
all ioctls, etc, have completed.

This closes a class of reader-writer races in which interfaces
could be removed during long-running ioctls, leading to crashes.
Many other consumers of ifunit() should now use ifunit_ref() to
avoid similar races.

MFC after:	3 weeks

1 files changed, 1 insertions, 0 deletions

diff --git a/sys/net/if_var.h b/sys/net/if_var.h
index 4078f8f..eb4986e 100644
--- a/sys/net/if_var.h
+++ b/sys/net/if_var.h
@@ -776,6 +776,7 @@ void	if_up(struct ifnet *);
 int	ifioctl(struct socket *, u_long, caddr_t, struct thread *);
 int	ifpromisc(struct ifnet *, int);
 struct	ifnet *ifunit(const char *);
+struct	ifnet *ifunit_ref(const char *);
 
 void	ifq_attach(struct ifaltq *, struct ifnet *ifp);
 void	ifq_detach(struct ifaltq *);