From 27974917a71ee694f9afff8b36daa38b5facfee1 Mon Sep 17 00:00:00 2001 From: Markus Pfeiffer Date: Thu, 26 Feb 2015 15:24:45 +0000 Subject: [PATCH] net/if_lagg: Fix double-free issue --- sys/net/lagg/if_lagg.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/sys/net/lagg/if_lagg.c b/sys/net/lagg/if_lagg.c index 5fb022c..362f0f1 100644 --- a/sys/net/lagg/if_lagg.c +++ b/sys/net/lagg/if_lagg.c @@ -357,8 +357,7 @@ lagg_clone_create(struct if_clone *ifc, int unit, caddr_t params __unused) * This uses the callout lock rather than the rmlock; one can't * hold said rmlock during SWI. */ - callout_init(&sc->sc_callout); - /*, &sc->sc_call_lock, 0); */ + callout_init_lk(&sc->sc_callout, &sc->sc_call_lock); /* Initialise pseudo media types */ ifmedia_init(&sc->sc_media, 0, lagg_media_change, @@ -433,7 +432,8 @@ lagg_clone_destroy(struct ifnet *ifp) sysctl_ctx_free(&sc->ctx); ifmedia_removeall(&sc->sc_media); ether_ifdetach(ifp); - if_free(ifp); + /* This ifp is part of lagg_softc, don't free it! */ + /* if_free(ifp); */ /* This grabs sc_callout_mtx, serialising it correctly */ callout_drain(&sc->sc_callout); -- 2.2.2