We link `ifp' to `if_list' before we perform if_attachsetup(). It is not

fully initialized because we initialize `if_groups' after linking. It's
not triggered because if_attach() and if_unit(9) are serialized by
kernel lock and `ifp' is often filled by nulls. Move `if_groups'
initialization to if_attach_common() to prevent this.

ok bluhm@ claudio@ deraadt@

diff --git a/sys/net/if.c b/sys/net/if.c
index e9c2950..32e6cf0 100644 (file)
--- a/sys/net/if.c
+++ b/sys/net/if.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: if.c,v 1.628 2021/02/10 14:41:53 bluhm Exp $  */
+/*     $OpenBSD: if.c,v 1.629 2021/02/11 20:28:01 mvs Exp $    */
 /*     $NetBSD: if.c,v 1.35 1996/05/07 05:26:04 thorpej Exp $  */
 
 /*
@@ -423,8 +423,6 @@ if_attachsetup(struct ifnet *ifp)
 
        NET_ASSERT_LOCKED();
 
-       TAILQ_INIT(&ifp->if_groups);
-
        if_addgroup(ifp, IFG_ALL);
 
        if_attachdomain(ifp);
@@ -596,6 +594,7 @@ if_attach_common(struct ifnet *ifp)
 
        TAILQ_INIT(&ifp->if_addrlist);
        TAILQ_INIT(&ifp->if_maddrlist);
+       TAILQ_INIT(&ifp->if_groups);
 
        if (!ISSET(ifp->if_xflags, IFXF_MPSAFE)) {
                KASSERTMSG(ifp->if_qstart == NULL,