From owner-svn-src-all@FreeBSD.ORG Fri Feb 13 19:20:25 2009 Return-Path: Delivered-To: svn-src-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 920931065670; Fri, 13 Feb 2009 19:20:25 +0000 (UTC) (envelope-from thompsa@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c]) by mx1.freebsd.org (Postfix) with ESMTP id 806BA8FC21; Fri, 13 Feb 2009 19:20:25 +0000 (UTC) (envelope-from thompsa@FreeBSD.org) Received: from svn.freebsd.org (localhost [127.0.0.1]) by svn.freebsd.org (8.14.3/8.14.3) with ESMTP id n1DJKPMd097105; Fri, 13 Feb 2009 19:20:25 GMT (envelope-from thompsa@svn.freebsd.org) Received: (from thompsa@localhost) by svn.freebsd.org (8.14.3/8.14.3/Submit) id n1DJKPIg097104; Fri, 13 Feb 2009 19:20:25 GMT (envelope-from thompsa@svn.freebsd.org) Message-Id: <200902131920.n1DJKPIg097104@svn.freebsd.org> From: Andrew Thompson Date: Fri, 13 Feb 2009 19:20:25 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cc: Subject: svn commit: r188594 - head/sys/net X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 13 Feb 2009 19:20:26 -0000 Author: thompsa Date: Fri Feb 13 19:20:25 2009 New Revision: 188594 URL: http://svn.freebsd.org/changeset/base/188594 Log: bridge_delete_member is called via the event handler from if_detach after the LLADDR is reclaimed which causes a null pointer deref with inherit_mac enabled. Record the ifnet pointer of the interface and then compare that to find when to re-assign the bridge address. Submitted by: sam Modified: head/sys/net/if_bridge.c Modified: head/sys/net/if_bridge.c ============================================================================== --- head/sys/net/if_bridge.c Fri Feb 13 19:16:15 2009 (r188593) +++ head/sys/net/if_bridge.c Fri Feb 13 19:20:25 2009 (r188594) @@ -220,6 +220,7 @@ struct bridge_softc { LIST_HEAD(, bridge_iflist) sc_spanlist; /* span ports list */ struct bstp_state sc_stp; /* STP state */ uint32_t sc_brtexceeded; /* # of cache drops */ + struct ifnet *sc_ifaddr; /* member mac copied from */ u_char sc_defaddr[6]; /* Default MAC address */ }; @@ -930,15 +931,16 @@ bridge_delete_member(struct bridge_softc * the mac address of the bridge to the address of the next member, or * to its default address if no members are left. */ - if (bridge_inherit_mac && - !memcmp(IF_LLADDR(sc->sc_ifp), IF_LLADDR(ifs), ETHER_ADDR_LEN)) { - if (LIST_EMPTY(&sc->sc_iflist)) + if (bridge_inherit_mac && sc->sc_ifaddr == ifs) { + if (LIST_EMPTY(&sc->sc_iflist)) { bcopy(sc->sc_defaddr, IF_LLADDR(sc->sc_ifp), ETHER_ADDR_LEN); - else { + sc->sc_ifaddr = NULL; + } else { fif = LIST_FIRST(&sc->sc_iflist)->bif_ifp; bcopy(IF_LLADDR(fif), IF_LLADDR(sc->sc_ifp), ETHER_ADDR_LEN); + sc->sc_ifaddr = fif; } } @@ -1039,8 +1041,10 @@ bridge_ioctl_add(struct bridge_softc *sc * the default randomly generated one. */ if (bridge_inherit_mac && LIST_EMPTY(&sc->sc_iflist) && - !memcmp(IF_LLADDR(sc->sc_ifp), sc->sc_defaddr, ETHER_ADDR_LEN)) + !memcmp(IF_LLADDR(sc->sc_ifp), sc->sc_defaddr, ETHER_ADDR_LEN)) { bcopy(IF_LLADDR(ifs), IF_LLADDR(sc->sc_ifp), ETHER_ADDR_LEN); + sc->sc_ifaddr = ifs; + } ifs->if_bridge = sc; bstp_create(&sc->sc_stp, &bif->bif_stp, bif->bif_ifp);