diff options
| author | David Gwynne <dlg@cvs.openbsd.org> | 2020-04-12 06:56:38 +0000 |
|---|---|---|
| committer | David Gwynne <dlg@cvs.openbsd.org> | 2020-04-12 06:56:38 +0000 |
| commit | a432f58ec77038b60408617922f76ded78a2c4ff (patch) | |
| tree | d7cbf110ab4dd2eb6edfa5100b3ff9d926d1b846 /sys | |
| parent | 4b96be288075fce42888d8ba0f4d42aa6cc0e4af (diff) | |
take NET_LOCK in tpmr_clone_destroy() before calling tpmr_p_dtor()
tpmr_p_dtor() calls ifpromisc(), and ifpromisc() callers need to
be holding NET_LOCK to make changes to if_flags and if_pcount, and
before calling the interfaces ioctl to apply the flag change.
found by hrvoje popovski who was testing tpmr with vlan interfaces.
vlan(4) asserts that the net lock is held in it's ioctl path, which
started this whole bug hunt.
ok visa@ (who came up with a similar diff, which hrvoje tested)
Diffstat (limited to 'sys')
| -rw-r--r-- | sys/net/if_tpmr.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/sys/net/if_tpmr.c b/sys/net/if_tpmr.c index d81183fe54e..6a1c7dfc72d 100644 --- a/sys/net/if_tpmr.c +++ b/sys/net/if_tpmr.c @@ -1,4 +1,4 @@ -/* $OpenBSD: if_tpmr.c,v 1.9 2020/04/11 11:01:03 dlg Exp $ */ +/* $OpenBSD: if_tpmr.c,v 1.10 2020/04/12 06:56:37 dlg Exp $ */ /* * Copyright (c) 2019 The University of Queensland @@ -201,12 +201,14 @@ tpmr_clone_destroy(struct ifnet *ifp) if_detach(ifp); + NET_LOCK(); for (i = 0; i < nitems(sc->sc_ports); i++) { struct tpmr_port *p = SMR_PTR_GET_LOCKED(&sc->sc_ports[i]); if (p == NULL) continue; tpmr_p_dtor(sc, p, "destroy"); } + NET_UNLOCK(); free(sc, M_DEVBUF, sizeof(*sc)); |