MFC 1.31:

  When a carp(4) interface is being destroyed and is in a promiscous mode,
  first interface is detached from parent and then bpfdetach() is called.
  If the interface was the last carp(4) interface attached to parent, then
  the mutex on parent is destroyed. When bpfdetach() calls if_setflags()
  we panic on destroyed mutex.

  To prevent the above scenario, clear pointer to parent, when we detach
  ourselves from parent.

Approved by:	re (kensmith)

1 files changed, 1 insertions, 0 deletions

diff --git a/sys/netinet/ip_carp.c b/sys/netinet/ip_carp.c
index 0f64e0e..292020f 100644
--- a/sys/netinet/ip_carp.c
+++ b/sys/netinet/ip_carp.c
@@ -443,6 +443,7 @@ carp_clone_destroy(struct ifnet *ifp)
 			CARP_LOCK_DESTROY(cif);
 			FREE(cif, M_CARP);
 			ifpromisc(sc->sc_carpdev, 0);
+			sc->sc_carpdev = NULL;
 		} else {
 			CARP_UNLOCK(cif);
 		}