From owner-cvs-src-old@FreeBSD.ORG Mon Apr 4 07:45:23 2011 Return-Path: Delivered-To: cvs-src-old@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id E23371065743 for ; Mon, 4 Apr 2011 07:45:23 +0000 (UTC) (envelope-from glebius@FreeBSD.org) Received: from repoman.freebsd.org (repoman.freebsd.org [IPv6:2001:4f8:fff6::29]) by mx1.freebsd.org (Postfix) with ESMTP id 931AC8FC17 for ; Mon, 4 Apr 2011 07:45:23 +0000 (UTC) Received: from repoman.freebsd.org (localhost [127.0.0.1]) by repoman.freebsd.org (8.14.4/8.14.4) with ESMTP id p347jNFs062048 for ; Mon, 4 Apr 2011 07:45:23 GMT (envelope-from glebius@repoman.freebsd.org) Received: (from svn2cvs@localhost) by repoman.freebsd.org (8.14.4/8.14.4/Submit) id p347jNSC062047 for cvs-src-old@freebsd.org; Mon, 4 Apr 2011 07:45:23 GMT (envelope-from glebius@repoman.freebsd.org) Message-Id: <201104040745.p347jNSC062047@repoman.freebsd.org> X-Authentication-Warning: repoman.freebsd.org: svn2cvs set sender to glebius@repoman.freebsd.org using -f From: Gleb Smirnoff Date: Mon, 4 Apr 2011 07:45:08 +0000 (UTC) To: cvs-src-old@freebsd.org X-FreeBSD-CVS-Branch: HEAD Subject: cvs commit: src/sys/net if.c X-BeenThere: cvs-src-old@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: **OBSOLETE** CVS commit messages for the src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 04 Apr 2011 07:45:24 -0000 glebius 2011-04-04 07:45:08 UTC FreeBSD src repository Modified files: sys/net if.c Log: SVN rev 220317 on 2011-04-04 07:45:08Z by glebius When removing ifnets, we should first remove the reference to ifnet from the interface index, then decrease refcount, not vice versa. Otherwise there is a race (reproducible) when if_free_internal() contests on IFNET_WLOCK(), and we got a zero-refed ifnet in the index for a long time. It may be picked by some other thread, that runs ifnet_byindex_ref(), who takes the ifnet from index, and bumps refcount. When reader drops the lock, if_free_internal() proceeds with free. Then reader tries to free it a second time. Revision Changes Path 1.399 +10 -9 src/sys/net/if.c