From static code analysis, some device drivers (cxgbe, mthca, mlx4 and qlnx) do not enter net epoch before lagg_input_infiniband(). If IPoIB interface is a member of lagg(4), after return from lagg_input_infiniban() the receiving interface of mbuf is set to lagg(4) interface. When concurrently destroying the interface, there's a small window that the interface get destroyed and become invalid before re-enter net epoch, thus leading use-after-free.
MFC after: 1 week