Fix a panic in softclock() if the interface is destroyed with a bpf consumer

attached.

This is caused by bpf_detachd clearing IFF_PROMISC on the interface which does
a SIOCSIFFLAGS ioctl. The problem here is that while the interface has been
stopped, IFF_UP has not been cleared so IFF_UP != IFF_DRV_RUNNING, this causes
the ioctl function to init() the interface which resets the callouts.

The destroy then completes and frees the softc but softclock will panic on a
dead callout pointer.

Ensure ifp->if_flags matches reality by clearing IFF_UP when we destroy.

Silence from:	rwatson
Approved by:	mlaier (mentor)
MFC after:	3 days

1 files changed, 1 insertions, 0 deletions

diff --git a/sys/net/if_bridge.c b/sys/net/if_bridge.c
index 7b53875..1b68d19 100644
--- a/sys/net/if_bridge.c
+++ b/sys/net/if_bridge.c
@@ -492,6 +492,7 @@ bridge_clone_destroy(struct ifnet *ifp)
 	BRIDGE_LOCK(sc);
 
 	bridge_stop(ifp, 1);
+	ifp->if_flags &= ~IFF_UP;
 
 	while ((bif = LIST_FIRST(&sc->sc_iflist)) != NULL)
 		bridge_delete_member(sc, bif);