From owner-svn-src-all@FreeBSD.ORG  Sun Apr 11 18:41:32 2010
Return-Path: <owner-svn-src-all@FreeBSD.ORG>
Delivered-To: svn-src-all@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 5116A106564A;
	Sun, 11 Apr 2010 18:41:32 +0000 (UTC) (envelope-from bz@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c])
	by mx1.freebsd.org (Postfix) with ESMTP id 407A68FC13;
	Sun, 11 Apr 2010 18:41:32 +0000 (UTC)
Received: from svn.freebsd.org (localhost [127.0.0.1])
	by svn.freebsd.org (8.14.3/8.14.3) with ESMTP id o3BIfWXm079066;
	Sun, 11 Apr 2010 18:41:32 GMT (envelope-from bz@svn.freebsd.org)
Received: (from bz@localhost)
	by svn.freebsd.org (8.14.3/8.14.3/Submit) id o3BIfWxG079064;
	Sun, 11 Apr 2010 18:41:32 GMT (envelope-from bz@svn.freebsd.org)
Message-Id: <201004111841.o3BIfWxG079064@svn.freebsd.org>
From: "Bjoern A. Zeeb" <bz@FreeBSD.org>
Date: Sun, 11 Apr 2010 18:41:32 +0000 (UTC)
To: src-committers@freebsd.org, svn-src-all@freebsd.org,
	svn-src-head@freebsd.org
X-SVN-Group: head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Cc: 
Subject: svn commit: r206486 - head/sys/net
X-BeenThere: svn-src-all@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "SVN commit messages for the entire src tree \(except for &quot;
	user&quot; and &quot; projects&quot; \)" <svn-src-all.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/svn-src-all>,
	<mailto:svn-src-all-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-src-all>
List-Post: <mailto:svn-src-all@freebsd.org>
List-Help: <mailto:svn-src-all-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/svn-src-all>,
	<mailto:svn-src-all-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 11 Apr 2010 18:41:32 -0000

Author: bz
Date: Sun Apr 11 18:41:31 2010
New Revision: 206486
URL: http://svn.freebsd.org/changeset/base/206486

Log:
  Check that the interface is on the list of cloned interfaces before trying
  to remove it to avoid panics in case of two threads trying to remove it in
  parallel.
  
  PR:		kern/116837
  Submitted by:	Takahiro Kurosawa (takahiro.kurosawa gmail.com) (orig version)
  MFC after:	10 days

Modified:
  head/sys/net/if_clone.c

Modified: head/sys/net/if_clone.c
==============================================================================
--- head/sys/net/if_clone.c	Sun Apr 11 16:28:10 2010	(r206485)
+++ head/sys/net/if_clone.c	Sun Apr 11 18:41:31 2010	(r206486)
@@ -234,6 +234,7 @@ int
 if_clone_destroyif(struct if_clone *ifc, struct ifnet *ifp)
 {
 	int err;
+	struct ifnet *ifcifp;
 
 	if (ifc->ifc_destroy == NULL)
 		return(EOPNOTSUPP);
@@ -246,8 +247,17 @@ if_clone_destroyif(struct if_clone *ifc,
 	CURVNET_SET_QUIET(ifp->if_vnet);
 
 	IF_CLONE_LOCK(ifc);
-	IFC_IFLIST_REMOVE(ifc, ifp);
+	LIST_FOREACH(ifcifp, &ifc->ifc_iflist, if_clones) {
+		if (ifcifp == ifp) {
+			IFC_IFLIST_REMOVE(ifc, ifp);
+			break;
+		}
+	}
 	IF_CLONE_UNLOCK(ifc);
+	if (ifcifp == NULL) {
+		CURVNET_RESTORE();
+		return (ENXIO);		/* ifp is not on the list. */
+	}
 
 	if_delgroup(ifp, ifc->ifc_name);