kern/52260: sys/net/if.c:if_detach in FreeBSD4 forgets resetting the ifindex2ifnet array

Jinmei Tatuya jinmei at
Wed May 14 21:50:07 PDT 2003

>Number:         52260
>Category:       kern
>Synopsis:       sys/net/if.c:if_detach in FreeBSD4 forgets resetting the ifindex2ifnet array
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed May 14 21:50:05 PDT 2003
>Originator:     Jinmei Tatuya
>Release:        FreeBSD 4.8-RELEASE i386
Toshiba Corporation / the KAME Project
System: FreeBSD 4.8-RELEASE FreeBSD 4.8-RELEASE #7: Thu May 8 22:57:19 JST 2003 jinmei at i386

machine: Toshiba Portege 2000
OS:FreeBSD 4.8 + KAME snap from the repository (around 20030510)
    (the bug is not specific to KAME snap, though)
sys/net/if.c:if_detach() does not NULL-clear the corresponding ifindex2ifnet[]
entry, so if we try to reuse the interface index for a detached interface,
the kernel will refer to a dangling pointer and cause an unexpected behavior
(perhaps a crash).

FreeBSD current apparently does not have this bug.
But this is quite critical, so I believe we should fix this on the
FreeBSD-4 branch as well.
I can't always reproduce the bug, but I once saw a kernel crash due to this
when I remove an IEEE 802 PCMCIA device from the laptop while running rtsold
on the wireless interface.
The following is a patch to FreeBSD 4.8 RELEASE to fix this.

--- if.c.orig	Thu May 15 12:58:18 2003
+++ if.c	Thu May 15 12:58:37 2003
@@ -310,6 +310,7 @@
 	/* Announce that the interface is gone. */
 	rt_ifannouncemsg(ifp, IFAN_DEPARTURE);
+	ifindex2ifnet[ifp->if_index] = NULL;
 	TAILQ_REMOVE(&ifnet, ifp, if_link);


More information about the freebsd-bugs mailing list