ng_eiface: fix kernel panic due to the racecondition in ng_eiface shutdown

[afedorov]

Summary

Call ifmedia_removeall () after ether_ifdetach () to prevent access to uninitialized data.

See https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=244247
https://bz-attachments.freebsd.org/attachment.cgi?id=211777

[vmaffione]

Looks good to me (with the suggested change). If I understand correctly, the crash happens when ng_eiface_mediastatus (which dereferences ifm->ifm_cur) is called after ifmedia_removeall (which sets ifm->ifm_cur = NULL, but before ether_ifdetach.

sys/netgraph/ng_eiface.c

628 ↗

(On Diff #70940)

Move the ifmedia_removeall before if_free, because the ifmedia callbacks need to access ifp, and so in theory the callbacks may be called after if_free and before ifmedia_removeall, resulting in a crash (if lucky).
Moreover, ifdetach --> ifmedia_removeall --> if_free is the same sequence used in all the other drivers.