[src/trunk]: src/sys/net Execute if_detach within splnet where vlan_unconfig is

[ozaki-r <ozaki-r%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/2da6a1788c66
branches:  trunk
changeset: 803036:2da6a1788c66
user:      ozaki-r <ozaki-r%NetBSD.org@localhost>
date:      Sat Oct 11 10:27:31 2014 +0000

description:
Execute if_detach within splnet where vlan_unconfig is

With the fix, a ifnet data of vlan can avoid use after free
that results in a fatal page fault.

This problem was found when fixing PR 49264. See
http://mail-index.netbsd.org/netbsd-bugs/2014/10/10/msg038536.html
for more detail.

diffstat:

 sys/net/if_vlan.c |  6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)

diffs (29 lines):

diff -r 572102d81fba -r 2da6a1788c66 sys/net/if_vlan.c
--- a/sys/net/if_vlan.c Sat Oct 11 10:18:36 2014 +0000
+++ b/sys/net/if_vlan.c Sat Oct 11 10:27:31 2014 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: if_vlan.c,v 1.77 2014/10/11 10:18:36 ozaki-r Exp $     */
+/*     $NetBSD: if_vlan.c,v 1.78 2014/10/11 10:27:31 ozaki-r Exp $     */
 
 /*-
  * Copyright (c) 2000, 2001 The NetBSD Foundation, Inc.
@@ -78,7 +78,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_vlan.c,v 1.77 2014/10/11 10:18:36 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_vlan.c,v 1.78 2014/10/11 10:27:31 ozaki-r Exp $");
 
 #include "opt_inet.h"
 
@@ -252,9 +252,9 @@
        s = splnet();
        LIST_REMOVE(ifv, ifv_list);
        vlan_unconfig(ifp);
+       if_detach(ifp);
        splx(s);
 
-       if_detach(ifp);
        free(ifv, M_DEVBUF);
 
        return (0);