When a carp(4) interface is being destroyed and is in a promiscous mode,

first interface is detached from parent and then bpfdetach() is called.
If the interface was the last carp(4) interface attached to parent, then
the mutex on parent is destroyed. When bpfdetach() calls if_setflags()
we panic on destroyed mutex.

To prevent the above scenario, clear pointer to parent, when we detach
ourselves from parent.

1 files changed, 1 insertions, 0 deletions

diff --git a/sys/netinet/ip_carp.c b/sys/netinet/ip_carp.c
index 606bf1c93179..7dd72c17eb12 100644
--- a/sys/netinet/ip_carp.c
+++ b/sys/netinet/ip_carp.c
@@ -443,6 +443,7 @@ carp_clone_destroy(struct ifnet *ifp)
 			CARP_LOCK_DESTROY(cif);
 			FREE(cif, M_CARP);
 			ifpromisc(sc->sc_carpdev, 0);
+			sc->sc_carpdev = NULL;
 		} else {
 			CARP_UNLOCK(cif);
 		}