Date: Thu, 27 Oct 2005 09:03:55 +1300 From: Andrew Thompson <thompsa@freebsd.org> To: Pawel Jakub Dawidek <pjd@FreeBSD.org> Cc: cvs-src@FreeBSD.org, src-committers@FreeBSD.org, cvs-all@FreeBSD.org Subject: Re: cvs commit: src/sys/net if_vlan.c Message-ID: <20051026200355.GA80702@heff.fud.org.nz> In-Reply-To: <200510261957.j9QJv438091618@repoman.freebsd.org> References: <200510261957.j9QJv438091618@repoman.freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, Oct 26, 2005 at 07:57:04PM +0000, Pawel Jakub Dawidek wrote: > pjd 2005-10-26 19:57:04 UTC > > FreeBSD src repository > > Modified files: (Branch: RELENG_6_0) > sys/net if_vlan.c > Log: > Call if_clone_detach() after vlan_clone_destroy() loop, as if_clone_detach() > is freeing ifc_units field, which is used in > vlan_clone_destroy()->ifc_free_unit(). > > This fixes panic: ifc_free_unit: bit is already cleared > > The fix introduces a small race in that a new interface could be created > between the vlan_clone_destroy() loop and the call to if_clone_detach(). > The race is probably too hard to trigger to be worry about it. > > This is not an MFC, because better fix was committed to HEAD. > We decided to use this fix, as it is a low-risk fix, which fits just fine > for 6.0 at this stage. Thanks! Another thing to note is without INVARIANTS this would have modified memory after free.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20051026200355.GA80702>