From: bluhm <bluhm@openbsd.org>
Date: Mon, 18 Dec 2023 13:30:44 +0000 (+0000)
Subject: Fix race between ifconfig destroy and ARP timer.
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=73fb5aae645f3bc12746fd705a937dfc9f9abc01;p=openbsd

Fix race between ifconfig destroy and ARP timer.

After if_detach() has called if_remove(), if_get() will return NULL.
Before if_detach() grabs the net lock, ARP timer can still run.  In
this case arptfree() should just return, instead of triggering an
assertion because ifp is NULL.  The ARP route will be deleted later
when in_ifdetach() calls in_purgeaddr().

OK kn@ mvs@ claudio@
---

diff --git a/sys/netinet/if_ether.c b/sys/netinet/if_ether.c
index 5ba3bcecef7..0d6c3d93049 100644
--- a/sys/netinet/if_ether.c
+++ b/sys/netinet/if_ether.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_ether.c,v 1.266 2023/11/09 21:45:18 bluhm Exp $	*/
+/*	$OpenBSD: if_ether.c,v 1.267 2023/12/18 13:30:44 bluhm Exp $	*/
 /*	$NetBSD: if_ether.c,v 1.31 1996/05/11 12:59:58 mycroft Exp $	*/
 
 /*
@@ -756,7 +756,8 @@ arptfree(struct rtentry *rt)
 	arpinvalidate(rt);
 
 	ifp = if_get(rt->rt_ifidx);
-	KASSERT(ifp != NULL);
+	if (ifp == NULL)
+		return;
 	if (!ISSET(rt->rt_flags, RTF_STATIC|RTF_CACHED))
 		rtdeletemsg(rt, ifp, ifp->if_rdomain);
 	if_put(ifp);