Return NULL instead of a bogus pointer from if_alloc when if_com_alloc
fails. Move detaching the ifnet from the ifindex_table into if_free so we can both keep the sanity checks and actually delete the ifnets. [0] Reported by: gallatin [0] Approved by: re (blanket)
This commit is contained in:
parent
b16d349f1b
commit
28ef2db496
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=147308
15
sys/net/if.c
15
sys/net/if.c
@ -402,8 +402,10 @@ if_alloc(u_char type)
|
||||
|
||||
if (if_com_alloc[type] != NULL) {
|
||||
ifp->if_l2com = if_com_alloc[type](type, ifp);
|
||||
if (ifp->if_l2com == NULL)
|
||||
if (ifp->if_l2com == NULL) {
|
||||
free(ifp, M_IFNET);
|
||||
return (NULL);
|
||||
}
|
||||
}
|
||||
|
||||
return (ifp);
|
||||
@ -426,6 +428,12 @@ if_free_type(struct ifnet *ifp, u_char type)
|
||||
return;
|
||||
}
|
||||
|
||||
ifnet_byindex(ifp->if_index) = NULL;
|
||||
|
||||
/* XXX: should be locked with if_findindex() */
|
||||
while (if_index > 0 && ifaddr_byindex(if_index) == NULL)
|
||||
if_index--;
|
||||
|
||||
if (if_com_free[type] != NULL)
|
||||
if_com_free[type](ifp->if_l2com, type);
|
||||
|
||||
@ -678,15 +686,10 @@ if_detach(struct ifnet *ifp)
|
||||
* Remove address from ifindex_table[] and maybe decrement if_index.
|
||||
* Clean up all addresses.
|
||||
*/
|
||||
ifnet_byindex(ifp->if_index) = NULL;
|
||||
ifaddr_byindex(ifp->if_index) = NULL;
|
||||
destroy_dev(ifdev_byindex(ifp->if_index));
|
||||
ifdev_byindex(ifp->if_index) = NULL;
|
||||
|
||||
while (if_index > 0 && ifaddr_byindex(if_index) == NULL)
|
||||
if_index--;
|
||||
|
||||
|
||||
/* We can now free link ifaddr. */
|
||||
if (!TAILQ_EMPTY(&ifp->if_addrhead)) {
|
||||
ifa = TAILQ_FIRST(&ifp->if_addrhead);
|
||||
|
Loading…
Reference in New Issue
Block a user