MFC (by ru)

| Fix "struct ifnet" leaks when attach() fails in the middle, e.g.
| when mii_phy_probe() or bus_setup_intr() fails.  For drivers that
| call their detach() in this case, call if_free() there to cover
| this case too.
|
| Revision  Changes    Path
| 1.168     +2 -2      src/sys/pci/if_dc.c
| 1.75      +2 -2      src/sys/pci/if_pcn.c
| 1.156     +3 -5      src/sys/pci/if_rl.c (already merged)
| 1.87      +2 -2      src/sys/pci/if_sf.c
| 1.136     +2 -3      src/sys/pci/if_sis.c
| 1.110     +2 -3      src/sys/pci/if_sk.c
| 1.89      +2 -2      src/sys/pci/if_ste.c
| 1.110     +2 -2      src/sys/pci/if_ti.c
| 1.103     +2 -2      src/sys/pci/if_tl.c
| 1.107     +2 -2      src/sys/pci/if_vr.c
| 1.83      +2 -2      src/sys/pci/if_wb.c
| 1.196     +2 -2      src/sys/pci/if_xl.c

Approved by:	re (scottl)

sys/pci/if_dc.c

@@ -2311,7 +2311,6 @@ dc_attach(device_t dev)
 	if (error) {
 		device_printf(dev, "couldn't set up irq\n");
 		ether_ifdetach(ifp);
-		if_free(ifp);
 		goto fail;
 	}
 
@@ -2353,8 +2352,9 @@ dc_detach(device_t dev)
 		DC_UNLOCK(sc);
 		callout_drain(&sc->dc_stat_ch);
 		ether_ifdetach(ifp);
-		if_free(ifp);
 	}
+	if (ifp)
+		if_free(ifp);
 	if (sc->dc_miibus)
 		device_delete_child(dev, sc->dc_miibus);
 	bus_generic_detach(dev);

sys/pci/if_pcn.c

@@ -623,7 +623,6 @@ pcn_attach(dev)
 	if (mii_phy_probe(dev, &sc->pcn_miibus,
 	    pcn_ifmedia_upd, pcn_ifmedia_sts)) {
 		printf("pcn%d: MII without any PHY!\n", sc->pcn_unit);
-		if_free(ifp);
 		error = ENXIO;
 		goto fail;
 	}
@@ -677,8 +676,9 @@ pcn_detach(dev)
 		PCN_UNLOCK(sc);
 		callout_drain(&sc->pcn_stat_callout);
 		ether_ifdetach(ifp);
-		if_free(ifp);
 	}
+	if (ifp)
+		if_free(ifp);
 	if (sc->pcn_miibus)
 		device_delete_child(dev, sc->pcn_miibus);
 	bus_generic_detach(dev);

sys/pci/if_sf.c

@@ -789,7 +789,6 @@ sf_attach(dev)
 	if (error) {
 		device_printf(dev, "couldn't set up irq\n");
 		ether_ifdetach(ifp);
-		if_free(ifp);
 		goto fail;
 	}
 
@@ -830,8 +829,9 @@ sf_detach(dev)
 		SF_UNLOCK(sc);
 		callout_drain(&sc->sf_stat_callout);
 		ether_ifdetach(ifp);
-		if_free(ifp);
 	}
+	if (ifp)
+		if_free(ifp);
 	if (sc->sf_miibus)
 		device_delete_child(dev, sc->sf_miibus);
 	bus_generic_detach(dev);

sys/pci/if_sis.c

@@ -1235,7 +1235,6 @@ sis_attach(device_t dev)
 	if (error) {
 		device_printf(dev, "couldn't set up irq\n");
 		ether_ifdetach(ifp);
-		if_free(ifp);
 		goto fail;
 	}
 
@@ -1276,8 +1275,9 @@ sis_detach(device_t dev)
 		SIS_UNLOCK(sc);
 		callout_drain(&sc->sis_stat_ch);
 		ether_ifdetach(ifp);
-		if_free(ifp);
 	}
+	if (ifp)
+		if_free(ifp);
 	if (sc->sis_miibus)
 		device_delete_child(dev, sc->sis_miibus);
 	bus_generic_detach(dev);

sys/pci/if_sk.c

@@ -1534,7 +1534,6 @@ sk_attach(dev)
 		    sc->sk_unit, sc_if->sk_phytype);
 		error = ENODEV;
 		SK_UNLOCK(sc);
-		if_free(ifp);
 		goto fail;
 	}
 
@@ -1565,7 +1564,6 @@ sk_attach(dev)
 	    sk_ifmedia_upd, sk_ifmedia_sts)) {
 		printf("skc%d: no PHY found!\n", sc_if->sk_unit);
 		ether_ifdetach(ifp);
-		if_free(ifp);
 		error = ENXIO;
 		goto fail;
 	}
@@ -1922,9 +1920,10 @@ sk_detach(dev)
 		/* Can't hold locks while calling detach */
 		SK_IF_UNLOCK(sc_if);
 		ether_ifdetach(ifp);
-		if_free(ifp);
 		SK_IF_LOCK(sc_if);
 	}
+	if (ifp)
+		if_free(ifp);
 	/*
 	 * We're generally called from skc_detach() which is using
 	 * device_delete_child() to get to here. It's already trashed

sys/pci/if_ste.c

@@ -1117,7 +1117,6 @@ ste_attach(dev)
 	if (error) {
 		device_printf(dev, "couldn't set up irq\n");
 		ether_ifdetach(ifp);
-		if_free(ifp);
 		goto fail;
 	}
 
@@ -1158,8 +1157,9 @@ ste_detach(dev)
 		STE_UNLOCK(sc);
 		callout_drain(&sc->ste_stat_callout);
 		ether_ifdetach(ifp);
-		if_free(ifp);
 	}
+	if (ifp)
+		if_free(ifp);
 	if (sc->ste_miibus)
 		device_delete_child(dev, sc->ste_miibus);
 	bus_generic_detach(dev);

sys/pci/if_ti.c

@@ -2292,7 +2292,6 @@ ti_attach(dev)
 	if (error) {
 		printf("ti%d: couldn't set up irq\n", unit);
 		ether_ifdetach(ifp);
-		if_free(ifp);
 		goto fail;
 	}
 
@@ -2328,9 +2327,10 @@ ti_detach(dev)
 	if (device_is_attached(dev)) {
 		ti_stop(sc);
 		ether_ifdetach(ifp);
-		if_free(ifp);
 		bus_generic_detach(dev);
 	}
+	if (ifp)
+		if_free(ifp);
 	ifmedia_removeall(&sc->ifmedia);
 
 	if (sc->ti_rdata)

sys/pci/if_tl.c

@@ -1307,7 +1307,6 @@ tl_attach(dev)
 	if (error) {
 		device_printf(dev, "couldn't set up irq\n");
 		ether_ifdetach(ifp);
-		if_free(ifp);
 		goto fail;
 	}
 
@@ -1343,8 +1342,9 @@ tl_detach(dev)
 		TL_UNLOCK(sc);
 		callout_drain(&sc->tl_stat_callout);
 		ether_ifdetach(ifp);
-		if_free(ifp);
 	}
+	if (ifp)
+		if_free(ifp);
 	if (sc->tl_miibus)
 		device_delete_child(dev, sc->tl_miibus);
 	bus_generic_detach(dev);

sys/pci/if_vr.c

@@ -773,7 +773,6 @@ vr_attach(dev)
 	if (error) {
 		printf("vr%d: couldn't set up irq\n", unit);
 		ether_ifdetach(ifp);
-		if_free(ifp);
 		goto fail;
 	}
 
@@ -813,9 +812,10 @@ vr_detach(device_t dev)
 		vr_stop(sc);
 		VR_UNLOCK(sc);		/* XXX: Avoid recursive acquire. */
 		ether_ifdetach(ifp);
-		if_free(ifp);
 		VR_LOCK(sc);
 	}
+	if (ifp)
+		if_free(ifp);
 	if (sc->vr_miibus)
 		device_delete_child(dev, sc->vr_miibus);
 	bus_generic_detach(dev);

sys/pci/if_wb.c

@@ -885,7 +885,6 @@ wb_attach(dev)
 	if (error) {
 		device_printf(dev, "couldn't set up irq\n");
 		ether_ifdetach(ifp);
-		if_free(ifp);
 		goto fail;
 	}
 
@@ -922,8 +921,9 @@ wb_detach(dev)
 	if (device_is_attached(dev)) {
 		wb_stop(sc);
 		ether_ifdetach(ifp);
-		if_free(ifp);
 	}
+	if (ifp)
+		if_free(ifp);
 	if (sc->wb_miibus)
 		device_delete_child(dev, sc->wb_miibus);
 	bus_generic_detach(dev);

sys/pci/if_xl.c

@@ -1607,7 +1607,6 @@ done:
 	if (error) {
 		device_printf(dev, "couldn't set up irq\n");
 		ether_ifdetach(ifp);
-		if_free(ifp);
 		goto fail;
 	}
 
@@ -1712,8 +1711,9 @@ xl_detach(device_t dev)
 		taskqueue_drain(taskqueue_swi, &sc->xl_task);
 		callout_drain(&sc->xl_stat_callout);
 		ether_ifdetach(ifp);
-		if_free(ifp);
 	}
+	if (ifp)
+		if_free(ifp);
 	if (sc->xl_miibus)
 		device_delete_child(dev, sc->xl_miibus);
 	bus_generic_detach(dev);