> thread 1 (mac_prop_update) thread 2 (link_detach) > > mp1 = mac_proplist_find > returns existing mac_proplist_t entry > > mac_prop_fini > kmem_free the mp1 > > mac.c line 2623 gets bad pointer > rw_enter(&mpl->mpl_lock, RW_WRITER);
Yes, rw_enter in mac_prop_update should be moved above mac_proplist_find. I'll fix that. thanks, -Artem
