Date: Sat, 27 Aug 2005 13:25:21 +1200 From: Andrew Thompson <thompsa@freebsd.org> To: src-committers@FreeBSD.org, cvs-src@FreeBSD.org, cvs-all@FreeBSD.org Subject: Re: cvs commit: src/sys/net if_bridge.c Message-ID: <20050827012521.GC44027@heff.fud.org.nz> In-Reply-To: <200508270117.j7R1Hgkw003979@repoman.freebsd.org> References: <200508270117.j7R1Hgkw003979@repoman.freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sat, Aug 27, 2005 at 01:17:42AM +0000, Andrew Thompson wrote: > thompsa 2005-08-27 01:17:42 UTC > > FreeBSD src repository > > Modified files: > sys/net if_bridge.c > Log: > Fix a panic in softclock() if the interface is destroyed with a bpf consumer > attached. > > This is caused by bpf_detachd clearing IFF_PROMISC on the interface which does > a SIOCSIFFLAGS ioctl. The problem here is that while the interface has been > stopped, IFF_UP has not been cleared so IFF_UP != IFF_DRV_RUNNING, this causes > the ioctl function to init() the interface which resets the callouts. > > The destroy then completes and frees the softc but softclock will panic on a > dead callout pointer. > > Ensure ifp->if_flags matches reality by clearing IFF_UP when we destroy. > Spotted by: pjd
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20050827012521.GC44027>