- Close a race during which the open flag could be cleared but the tun_softc would still be referenced

  by adding a separate TUN_CLOSED flag that is set after tunclose is done referencing it.

- drop the tun_mtx after the flag check to avoid holding it across if_detach which can recurse in to
  if_tun.c

1 files changed, 6 insertions, 2 deletions

diff --git a/sys/net/if_tun.c b/sys/net/if_tun.c
index 8187b74..2520883 100644
--- a/sys/net/if_tun.c
+++ b/sys/net/if_tun.c
@@ -79,6 +79,7 @@ struct tun_softc {
 #define	TUN_RWAIT	0x0040
 #define	TUN_ASYNC	0x0080
 #define	TUN_IFHEAD	0x0100
+#define	TUN_CLOSED	0x0200
 
 #define TUN_READY       (TUN_OPEN | TUN_INITED)
 
@@ -256,9 +257,11 @@ tun_destroy(struct tun_softc *tp)
 
 	/* Unlocked read. */
 	mtx_lock(&tp->tun_mtx);
-	if ((tp->tun_flags & TUN_OPEN) != 0)
+	if ((tp->tun_flags & (TUN_OPEN|TUN_CLOSED)) != TUN_CLOSED)
 		cv_wait_unlock(&tp->tun_cv, &tp->tun_mtx);
-
+	else
+		mtx_unlock(&tp->tun_mtx);
+	    
 	CURVNET_SET(TUN2IFP(tp)->if_vnet);
 	dev = tp->tun_dev;
 	bpfdetach(TUN2IFP(tp));
@@ -497,6 +500,7 @@ tunclose(struct cdev *dev, int foo, int bar, struct thread *td)
 	KNOTE_UNLOCKED(&tp->tun_rsel.si_note, 0);
 	TUNDEBUG (ifp, "closed\n");
 
+	tp->tun_flags |= TUN_CLOSED;
 	cv_broadcast(&tp->tun_cv);
 	mtx_unlock(&tp->tun_mtx);
 	return (0);