Make sure that we call if_free(ifp) after bus_teardown_intr. Since we

could get an interrupt after we free the ifp, and the interrupt
handler depended on the ifp being still alive, this could, in theory,
cause a crash.  Eliminate this possibility by moving the if_free to
after the bus_teardown_intr() call.

1 files changed, 1 insertions, 1 deletions

diff --git a/sys/dev/ed/if_ed.c b/sys/dev/ed/if_ed.c
index e76c0c8ca9dd..0cbe2b3b044f 100644
--- a/sys/dev/ed/if_ed.c
+++ b/sys/dev/ed/if_ed.c
@@ -369,8 +369,8 @@ ed_detach(device_t dev)
 	callout_drain(&sc->tick_ch);
 	ether_ifdetach(ifp);
 	bus_teardown_intr(dev, sc->irq_res, sc->irq_handle);
-	if_free(ifp);
 	ed_release_resources(dev);
+	if_free(ifp);
 	ED_LOCK_DESTROY(sc);
 	return (0);
 }