Date: Wed, 12 Oct 2005 19:52:16 +0000 (UTC) From: Andrew Thompson <thompsa@FreeBSD.org> To: src-committers@FreeBSD.org, cvs-src@FreeBSD.org, cvs-all@FreeBSD.org Subject: cvs commit: src/sys/contrib/pf/net if_pflog.c if_pfsync.c src/sys/net if_bridge.c if_clone.c if_disc.c if_faith.c if_gif.c if_gre.c if_ppp.c if_stf.c src/sys/netinet ip_carp.c Message-ID: <200510121952.j9CJqGS3066438@repoman.freebsd.org>
next in thread | raw e-mail | index | archive | help
thompsa 2005-10-12 19:52:16 UTC
FreeBSD src repository
Modified files:
sys/contrib/pf/net if_pflog.c if_pfsync.c
sys/net if_bridge.c if_clone.c if_disc.c
if_faith.c if_gif.c if_gre.c if_ppp.c
if_stf.c
sys/netinet ip_carp.c
Log:
Change the reference counting to count the number of cloned interfaces for each
cloner. This ensures that ifc->ifc_units is not prematurely freed in
if_clone_detach() before the clones are destroyed, resulting in memory modified
after free. This could be triggered with if_vlan.
Assert that all cloners have been destroyed when freeing the memory.
Change all simple cloners to destroy their clones with ifc_simple_destroy() on
module unload so the reference count is properly updated. This also cleans up
the interface destroy routines and allows future optimisation.
Discussed with: brooks, pjd, -current
Reviewed by: brooks
Revision Changes Path
1.16 +2 -1 src/sys/contrib/pf/net/if_pflog.c
1.24 +1 -1 src/sys/contrib/pf/net/if_pfsync.c
1.24 +2 -1 src/sys/net/if_bridge.c
1.7 +13 -5 src/sys/net/if_clone.c
1.49 +6 -14 src/sys/net/if_disc.c
1.38 +5 -14 src/sys/net/if_faith.c
1.55 +8 -16 src/sys/net/if_gif.c
1.35 +10 -17 src/sys/net/if_gre.c
1.109 +8 -17 src/sys/net/if_ppp.c
1.51 +9 -17 src/sys/net/if_stf.c
1.32 +2 -1 src/sys/netinet/ip_carp.c
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200510121952.j9CJqGS3066438>