From d6130a47038460d2093bdc0fcdadd546393cc823 Mon Sep 17 00:00:00 2001 From: thompsa Date: Wed, 12 Oct 2005 19:52:16 +0000 Subject: Change the reference counting to count the number of cloned interfaces for each cloner. This ensures that ifc->ifc_units is not prematurely freed in if_clone_detach() before the clones are destroyed, resulting in memory modified after free. This could be triggered with if_vlan. Assert that all cloners have been destroyed when freeing the memory. Change all simple cloners to destroy their clones with ifc_simple_destroy() on module unload so the reference count is properly updated. This also cleans up the interface destroy routines and allows future optimisation. Discussed with: brooks, pjd, -current Reviewed by: brooks --- sys/net/if_disc.c | 20 ++++++-------------- 1 file changed, 6 insertions(+), 14 deletions(-) (limited to 'sys/net/if_disc.c') diff --git a/sys/net/if_disc.c b/sys/net/if_disc.c index d94eeeb..3b0804e 100644 --- a/sys/net/if_disc.c +++ b/sys/net/if_disc.c @@ -111,17 +111,6 @@ disc_clone_create(struct if_clone *ifc, int unit) } static void -disc_destroy(struct disc_softc *sc) -{ - - bpfdetach(sc->sc_ifp); - if_detach(sc->sc_ifp); - if_free(sc->sc_ifp); - - free(sc, M_DISC); -} - -static void disc_clone_destroy(struct ifnet *ifp) { struct disc_softc *sc; @@ -131,7 +120,11 @@ disc_clone_destroy(struct ifnet *ifp) LIST_REMOVE(sc, sc_list); mtx_unlock(&disc_mtx); - disc_destroy(sc); + bpfdetach(ifp); + if_detach(ifp); + if_free(ifp); + + free(sc, M_DISC); } static int @@ -150,9 +143,8 @@ disc_modevent(module_t mod, int type, void *data) mtx_lock(&disc_mtx); while ((sc = LIST_FIRST(&disc_softc_list)) != NULL) { - LIST_REMOVE(sc, sc_list); mtx_unlock(&disc_mtx); - disc_destroy(sc); + ifc_simple_destroy(&disc_cloner, sc->sc_ifp); mtx_lock(&disc_mtx); } mtx_unlock(&disc_mtx); -- cgit v1.1