svn commit: r260411 - head/sys/dev/netmap

[Luigi Rizzo]

Author: luigi
Date: Tue Jan  7 21:14:28 2014
New Revision: 260411
URL: http://svnweb.freebsd.org/changeset/base/260411

Log:
  fix use after free when releasing a netmap adapter.
  
  Submitted by:	Giuseppe Lettieri

Modified:
  head/sys/dev/netmap/netmap.c
  head/sys/dev/netmap/netmap_kern.h

Modified: head/sys/dev/netmap/netmap.c
==============================================================================
--- head/sys/dev/netmap/netmap.c	Tue Jan  7 21:04:49 2014	(r260410)
+++ head/sys/dev/netmap/netmap.c	Tue Jan  7 21:14:28 2014	(r260411)
@@ -2208,9 +2208,14 @@ netmap_detach(struct ifnet *ifp)
 
 	NMG_LOCK();
 	netmap_disable_all_rings(ifp);
-	netmap_adapter_put(na);
-	na->ifp = NULL;
-	netmap_enable_all_rings(ifp);
+	if (!netmap_adapter_put(na)) {
+		/* someone is still using the adapter,
+		 * tell them that the interface is gone
+		 */
+		na->ifp = NULL;
+		/* give them a chance to notice */
+		netmap_enable_all_rings(ifp);
+	}
 	NMG_UNLOCK();
 }
 

Modified: head/sys/dev/netmap/netmap_kern.h
==============================================================================
--- head/sys/dev/netmap/netmap_kern.h	Tue Jan  7 21:04:49 2014	(r260410)
+++ head/sys/dev/netmap/netmap_kern.h	Tue Jan  7 21:14:28 2014	(r260411)
@@ -899,11 +899,11 @@ void __netmap_adapter_get(struct netmap_
 int __netmap_adapter_put(struct netmap_adapter *na);
 
 #define netmap_adapter_put(na)				\
-	do {						\
+	({						\
 		struct netmap_adapter *__na = na;	\
 		D("putting %p:%s (%d)", __na, NM_IFPNAME(__na->ifp), __na->na_refcount);	\
 		__netmap_adapter_put(__na);		\
-	} while (0)
+	})
 
 #else /* !NM_DEBUG_PUTGET */