GPF when doing jail -r, possibly an use-after-free

[Bjoern A. Zeeb]

On 5. Jul 2012, at 19:53 , Mikolaj Golub wrote:

> 
> On Thu, 05 Jul 2012 12:18:20 -0700 Xin Li wrote:
> 
> XL> Hi, Mikolaj,
> 
> XL> On 07/04/12 00:00, Mikolaj Golub wrote:
>>> Is this observed after destroying epair? There is an issue with
>>> epair: on destroy, when epair_clone_destroy() calls
>>> ether_ifdetach() for its second half it does not switch to its vnet
>>> and if_detach_internal() can't find the interface and just returns.
>>> As a result V_ifnet list is left with dead reference.
> 
> XL> Yes.
> 
>>> http://lists.freebsd.org/pipermail/freebsd-virtualization/2011-January/000628.html
>>> 
>>> Here is an updated patch against CURRENT:
>>> 
>>> http://people.freebsd.org/~trociny/if_epair.c.epair_clone_destroy.1.patch
> 
> XL> Your
>>> 
> XL> patch did fixed the problem, thanks!  Are you going to commit it
> XL> against -HEAD and then MFC after a while?
> 
> I would like Bjoern review it before me committing, or at least tell he does
> not mind, if he does not have time to review -)

To me the patch looks wrong; I am wondering if someone broke some other central
assumptions but given I cannot currently spend time on this and if it fixes things
feel free to go ahead.

/bz

-- 
Bjoern A. Zeeb                                 You have to have visions!
   It does not matter how good you are. It matters what good you do!