Author: asomers
Date: Tue Oct 7 15:21:20 2014
New Revision: 272705
URL: https://svnweb.freebsd.org/changeset/base/272705
Log:
MFC r265232
Fix a panic caused by doing "ifconfig -am" while a lagg is being destroyed.
The thread that is destroying the lagg has already set sc->sc_psc=NULL when
the "ifconfig -am" thread gets to lacp_req(). It tries to dereference
sc->sc_psc and panics. The solution is for lacp_req() to check the value of
sc->sc_psc. If NULL, harmlessly return an lacp_opreq structure full of
zeros. Full details in GNATS.
PR: 189003
Modified:
stable/9/sys/net/ieee8023ad_lacp.c
Directory Properties:
stable/9/ (props changed)
stable/9/sys/ (props changed)
stable/9/sys/net/ (props changed)
Modified: stable/9/sys/net/ieee8023ad_lacp.c
==============================================================================
--- stable/9/sys/net/ieee8023ad_lacp.c Tue Oct 7 15:12:06 2014
(r272704)
+++ stable/9/sys/net/ieee8023ad_lacp.c Tue Oct 7 15:21:20 2014
(r272705)
@@ -584,10 +584,20 @@ lacp_req(struct lagg_softc *sc, caddr_t
{
struct lacp_opreq *req = (struct lacp_opreq *)data;
struct lacp_softc *lsc = LACP_SOFTC(sc);
- struct lacp_aggregator *la = lsc->lsc_active_aggregator;
+ struct lacp_aggregator *la;
- LACP_LOCK(lsc);
bzero(req, sizeof(struct lacp_opreq));
+
+ /*
+ * If the LACP softc is NULL, return with the opreq structure full of
+ * zeros. It is normal for the softc to be NULL while the lagg is
+ * being destroyed.
+ */
+ if (NULL == lsc)
+ return;
+
+ la = lsc->lsc_active_aggregator;
+ LACP_LOCK(lsc);
if (la != NULL) {
req->actor_prio = ntohs(la->la_actor.lip_systemid.lsi_prio);
memcpy(&req->actor_mac, &la->la_actor.lip_systemid.lsi_mac,
_______________________________________________
svn-src-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
