svn commit: r188595 - in projects/vap7/sys: . contrib/pf dev dev/ath dev/ath/ath_hal dev/ath/ath_hal/ar5210 dev/ath/ath_hal/ar5211 dev/ath/ath_hal/ar5212 dev/ath/ath_hal/ar5312 dev/ath/ath_hal/ar54...

[Sam Leffler]

Author: sam
Date: Fri Feb 13 19:25:35 2009
New Revision: 188595
URL: http://svn.freebsd.org/changeset/base/188595

Log:
  merge r188594: fix null ptr deref on ifnet removal w/ inherit_mac enabled

Modified:
  projects/vap7/sys/   (props changed)
  projects/vap7/sys/contrib/pf/   (props changed)
  projects/vap7/sys/dev/   (props changed)
  projects/vap7/sys/dev/ath/   (props changed)
  projects/vap7/sys/dev/ath/ath_hal/   (props changed)
  projects/vap7/sys/dev/ath/ath_hal/ar5210/   (props changed)
  projects/vap7/sys/dev/ath/ath_hal/ar5211/   (props changed)
  projects/vap7/sys/dev/ath/ath_hal/ar5212/   (props changed)
  projects/vap7/sys/dev/ath/ath_hal/ar5312/   (props changed)
  projects/vap7/sys/dev/ath/ath_hal/ar5416/   (props changed)
  projects/vap7/sys/dev/cxgb/   (props changed)
  projects/vap7/sys/dev/usb2/   (props changed)
  projects/vap7/sys/i386/conf/USB2   (props changed)
  projects/vap7/sys/modules/usb2/   (props changed)
  projects/vap7/sys/net/if_bridge.c
  projects/vap7/sys/net80211/   (props changed)

Modified: projects/vap7/sys/net/if_bridge.c
==============================================================================
--- projects/vap7/sys/net/if_bridge.c	Fri Feb 13 19:20:25 2009	(r188594)
+++ projects/vap7/sys/net/if_bridge.c	Fri Feb 13 19:25:35 2009	(r188595)
@@ -220,6 +220,7 @@ struct bridge_softc {
 	LIST_HEAD(, bridge_iflist) sc_spanlist;	/* span ports list */
 	struct bstp_state	sc_stp;		/* STP state */
 	uint32_t		sc_brtexceeded;	/* # of cache drops */
+	struct ifnet		*sc_ifaddr;	/* member mac copied from */
 	u_char			sc_defaddr[6];	/* Default MAC address */
 };
 
@@ -925,15 +926,16 @@ bridge_delete_member(struct bridge_softc
 	 * the mac address of the bridge to the address of the next member, or
 	 * to its default address if no members are left.
 	 */
-	if (bridge_inherit_mac &&
-	    !memcmp(IF_LLADDR(sc->sc_ifp), IF_LLADDR(ifs), ETHER_ADDR_LEN)) {
-		if (LIST_EMPTY(&sc->sc_iflist))
+	if (bridge_inherit_mac && sc->sc_ifaddr == ifs) {
+		if (LIST_EMPTY(&sc->sc_iflist)) {
 			bcopy(sc->sc_defaddr,
 			    IF_LLADDR(sc->sc_ifp), ETHER_ADDR_LEN);
-		else {
+			sc->sc_ifaddr = NULL;
+		} else {
 			fif = LIST_FIRST(&sc->sc_iflist)->bif_ifp;
 			bcopy(IF_LLADDR(fif),
 			    IF_LLADDR(sc->sc_ifp), ETHER_ADDR_LEN);
+			sc->sc_ifaddr = fif;
 		}
 	}
 
@@ -1035,8 +1037,10 @@ bridge_ioctl_add(struct bridge_softc *sc
 	 * the default randomly generated one.
 	 */
 	if (bridge_inherit_mac && LIST_EMPTY(&sc->sc_iflist) &&
-	    !memcmp(IF_LLADDR(sc->sc_ifp), sc->sc_defaddr, ETHER_ADDR_LEN))
+	    !memcmp(IF_LLADDR(sc->sc_ifp), sc->sc_defaddr, ETHER_ADDR_LEN)) {
 		bcopy(IF_LLADDR(ifs), IF_LLADDR(sc->sc_ifp), ETHER_ADDR_LEN);
+		sc->sc_ifaddr = ifs;
+	}
 
 	ifs->if_bridge = sc;
 	bstp_create(&sc->sc_stp, &bif->bif_stp, bif->bif_ifp);