diff options
| author | emaste <emaste@FreeBSD.org> | 2012-09-25 22:10:14 +0000 |
|---|---|---|
| committer | emaste <emaste@FreeBSD.org> | 2012-09-25 22:10:14 +0000 |
| commit | e89f1e29503b91186f3a0112d505bbf1cf134d22 (patch) | |
| tree | 3710e3522127c270251c24df5491c598b5d8045f | |
| parent | b79f4497f47c4bf0824bf360a49bc975c3ee62ba (diff) | |
| download | FreeBSD-src-e89f1e29503b91186f3a0112d505bbf1cf134d22.zip FreeBSD-src-e89f1e29503b91186f3a0112d505bbf1cf134d22.tar.gz | |
Avoid INVARIANTS panic destroying an in-use tap(4)
The requirement (implied by the KASSERT in tap_destroy) that the tap is
closed isn't valid; destroy_dev will block in devdrn while other threads
are in d_* functions.
Note: if_tun had the same issue, addressed in SVN revisions r186391,
r186483 and r186497. The use of the condvar there appears to be
redundant with the functionality provided by destroy_dev.
Sponsored by: ADARA Networks
Reviewed by: dwhite
MFC after: 2 weeks
| -rw-r--r-- | sys/net/if_tap.c | 6 | ||||
| -rw-r--r-- | sys/net/if_tapvar.h | 1 |
2 files changed, 2 insertions, 5 deletions
diff --git a/sys/net/if_tap.c b/sys/net/if_tap.c index 201f976..7052fea 100644 --- a/sys/net/if_tap.c +++ b/sys/net/if_tap.c @@ -213,14 +213,10 @@ tap_destroy(struct tap_softc *tp) { struct ifnet *ifp = tp->tap_ifp; - /* Unlocked read. */ - KASSERT(!(tp->tap_flags & TAP_OPEN), - ("%s flags is out of sync", ifp->if_xname)); - CURVNET_SET(ifp->if_vnet); + destroy_dev(tp->tap_dev); seldrain(&tp->tap_rsel); knlist_destroy(&tp->tap_rsel.si_note); - destroy_dev(tp->tap_dev); ether_ifdetach(ifp); if_free(ifp); diff --git a/sys/net/if_tapvar.h b/sys/net/if_tapvar.h index 21bac50..fb1c39a 100644 --- a/sys/net/if_tapvar.h +++ b/sys/net/if_tapvar.h @@ -64,6 +64,7 @@ struct tap_softc { SLIST_ENTRY(tap_softc) tap_next; /* next device in chain */ struct cdev *tap_dev; struct mtx tap_mtx; /* per-softc mutex */ + struct cv tap_cv; /* protect ref'd dev destroy */ }; #endif /* !_NET_IF_TAPVAR_H_ */ |
