Module Name: src
Committed By: ozaki-r
Date: Sat Oct 11 10:27:31 UTC 2014
Modified Files:
src/sys/net: if_vlan.c
Log Message:
Execute if_detach within splnet where vlan_unconfig is
With the fix, a ifnet data of vlan can avoid use after free
that results in a fatal page fault.
This problem was found when fixing PR 49264. See
http://mail-index.netbsd.org/netbsd-bugs/2014/10/10/msg038536.html
for more detail.
To generate a diff of this commit:
cvs rdiff -u -r1.77 -r1.78 src/sys/net/if_vlan.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/net/if_vlan.c
diff -u src/sys/net/if_vlan.c:1.77 src/sys/net/if_vlan.c:1.78
--- src/sys/net/if_vlan.c:1.77 Sat Oct 11 10:18:36 2014
+++ src/sys/net/if_vlan.c Sat Oct 11 10:27:31 2014
@@ -1,4 +1,4 @@
-/* $NetBSD: if_vlan.c,v 1.77 2014/10/11 10:18:36 ozaki-r Exp $ */
+/* $NetBSD: if_vlan.c,v 1.78 2014/10/11 10:27:31 ozaki-r Exp $ */
/*-
* Copyright (c) 2000, 2001 The NetBSD Foundation, Inc.
@@ -78,7 +78,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_vlan.c,v 1.77 2014/10/11 10:18:36 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_vlan.c,v 1.78 2014/10/11 10:27:31 ozaki-r Exp $");
#include "opt_inet.h"
@@ -252,9 +252,9 @@ vlan_clone_destroy(struct ifnet *ifp)
s = splnet();
LIST_REMOVE(ifv, ifv_list);
vlan_unconfig(ifp);
+ if_detach(ifp);
splx(s);
- if_detach(ifp);
free(ifv, M_DEVBUF);
return (0);
