svn commit: r188594 - head/sys/net

[Andrew Thompson]

Author: thompsa
Date: Fri Feb 13 19:20:25 2009
New Revision: 188594
URL: http://svn.freebsd.org/changeset/base/188594

Log:
  bridge_delete_member is called via the event handler from if_detach
  after the LLADDR is reclaimed which causes a null pointer deref with
  inherit_mac enabled. Record the ifnet pointer of the interface and then compare
  that to find when to re-assign the bridge address.
  
  Submitted by:	sam

Modified:
  head/sys/net/if_bridge.c

Modified: head/sys/net/if_bridge.c
==============================================================================
--- head/sys/net/if_bridge.c	Fri Feb 13 19:16:15 2009	(r188593)
+++ head/sys/net/if_bridge.c	Fri Feb 13 19:20:25 2009	(r188594)
@@ -220,6 +220,7 @@ struct bridge_softc {
 	LIST_HEAD(, bridge_iflist) sc_spanlist;	/* span ports list */
 	struct bstp_state	sc_stp;		/* STP state */
 	uint32_t		sc_brtexceeded;	/* # of cache drops */
+	struct ifnet		*sc_ifaddr;	/* member mac copied from */
 	u_char			sc_defaddr[6];	/* Default MAC address */
 };
 
@@ -930,15 +931,16 @@ bridge_delete_member(struct bridge_softc
 	 * the mac address of the bridge to the address of the next member, or
 	 * to its default address if no members are left.
 	 */
-	if (bridge_inherit_mac &&
-	    !memcmp(IF_LLADDR(sc->sc_ifp), IF_LLADDR(ifs), ETHER_ADDR_LEN)) {
-		if (LIST_EMPTY(&sc->sc_iflist))
+	if (bridge_inherit_mac && sc->sc_ifaddr == ifs) {
+		if (LIST_EMPTY(&sc->sc_iflist)) {
 			bcopy(sc->sc_defaddr,
 			    IF_LLADDR(sc->sc_ifp), ETHER_ADDR_LEN);
-		else {
+			sc->sc_ifaddr = NULL;
+		} else {
 			fif = LIST_FIRST(&sc->sc_iflist)->bif_ifp;
 			bcopy(IF_LLADDR(fif),
 			    IF_LLADDR(sc->sc_ifp), ETHER_ADDR_LEN);
+			sc->sc_ifaddr = fif;
 		}
 	}
 
@@ -1039,8 +1041,10 @@ bridge_ioctl_add(struct bridge_softc *sc
 	 * the default randomly generated one.
 	 */
 	if (bridge_inherit_mac && LIST_EMPTY(&sc->sc_iflist) &&
-	    !memcmp(IF_LLADDR(sc->sc_ifp), sc->sc_defaddr, ETHER_ADDR_LEN))
+	    !memcmp(IF_LLADDR(sc->sc_ifp), sc->sc_defaddr, ETHER_ADDR_LEN)) {
 		bcopy(IF_LLADDR(ifs), IF_LLADDR(sc->sc_ifp), ETHER_ADDR_LEN);
+		sc->sc_ifaddr = ifs;
+	}
 
 	ifs->if_bridge = sc;
 	bstp_create(&sc->sc_stp, &bif->bif_stp, bif->bif_ifp);