>    thread 1 (mac_prop_update)                  thread 2 (link_detach)
> 
>    mp1 = mac_proplist_find
>    returns existing mac_proplist_t entry
> 
>                                                mac_prop_fini
>                                                   kmem_free the mp1
> 
>   mac.c line 2623 gets bad pointer
>    rw_enter(&mpl->mpl_lock, RW_WRITER);

Yes, rw_enter in mac_prop_update should be moved above 
mac_proplist_find. I'll fix that.

thanks,
-Artem

Reply via email to