From owner-cvs-src@FreeBSD.ORG  Wed Oct 26 20:03:57 2005
Return-Path: <owner-cvs-src@FreeBSD.ORG>
X-Original-To: cvs-src@FreeBSD.org
Delivered-To: cvs-src@FreeBSD.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id A1B0316A41F;
	Wed, 26 Oct 2005 20:03:57 +0000 (GMT)
	(envelope-from thompsa@freebsd.org)
Received: from heff.fud.org.nz (60-234-149-201.bitstream.orcon.net.nz
	[60.234.149.201])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 26E6E43D45;
	Wed, 26 Oct 2005 20:03:57 +0000 (GMT)
	(envelope-from thompsa@freebsd.org)
Received: by heff.fud.org.nz (Postfix, from userid 1001)
	id C53951CCDD; Thu, 27 Oct 2005 09:03:55 +1300 (NZDT)
Date: Thu, 27 Oct 2005 09:03:55 +1300
From: Andrew Thompson <thompsa@freebsd.org>
To: Pawel Jakub Dawidek <pjd@FreeBSD.org>
Message-ID: <20051026200355.GA80702@heff.fud.org.nz>
References: <200510261957.j9QJv438091618@repoman.freebsd.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <200510261957.j9QJv438091618@repoman.freebsd.org>
User-Agent: Mutt/1.4.2.1i
Cc: cvs-src@FreeBSD.org, src-committers@FreeBSD.org, cvs-all@FreeBSD.org
Subject: Re: cvs commit: src/sys/net if_vlan.c
X-BeenThere: cvs-src@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: CVS commit messages for the src tree <cvs-src.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/cvs-src>,
	<mailto:cvs-src-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/cvs-src>
List-Post: <mailto:cvs-src@freebsd.org>
List-Help: <mailto:cvs-src-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/cvs-src>,
	<mailto:cvs-src-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 26 Oct 2005 20:03:57 -0000

On Wed, Oct 26, 2005 at 07:57:04PM +0000, Pawel Jakub Dawidek wrote:
> pjd         2005-10-26 19:57:04 UTC
> 
>   FreeBSD src repository
> 
>   Modified files:        (Branch: RELENG_6_0)
>     sys/net              if_vlan.c 
>   Log:
>   Call if_clone_detach() after vlan_clone_destroy() loop, as if_clone_detach()
>   is freeing ifc_units field, which is used in
>   vlan_clone_destroy()->ifc_free_unit().
>   
>   This fixes panic: ifc_free_unit: bit is already cleared
>   
>   The fix introduces a small race in that a new interface could be created
>   between the vlan_clone_destroy() loop and the call to if_clone_detach().
>   The race is probably too hard to trigger to be worry about it.
>   
>   This is not an MFC, because better fix was committed to HEAD.
>   We decided to use this fix, as it is a low-risk fix, which fits just fine
>   for 6.0 at this stage.
  
Thanks!

Another thing to note is without INVARIANTS this would have modified
memory after free.