From e89f1e29503b91186f3a0112d505bbf1cf134d22 Mon Sep 17 00:00:00 2001 From: emaste Date: Tue, 25 Sep 2012 22:10:14 +0000 Subject: Avoid INVARIANTS panic destroying an in-use tap(4) The requirement (implied by the KASSERT in tap_destroy) that the tap is closed isn't valid; destroy_dev will block in devdrn while other threads are in d_* functions. Note: if_tun had the same issue, addressed in SVN revisions r186391, r186483 and r186497. The use of the condvar there appears to be redundant with the functionality provided by destroy_dev. Sponsored by: ADARA Networks Reviewed by: dwhite MFC after: 2 weeks --- sys/net/if_tap.c | 6 +----- sys/net/if_tapvar.h | 1 + 2 files changed, 2 insertions(+), 5 deletions(-) diff --git a/sys/net/if_tap.c b/sys/net/if_tap.c index 201f976..7052fea 100644 --- a/sys/net/if_tap.c +++ b/sys/net/if_tap.c @@ -213,14 +213,10 @@ tap_destroy(struct tap_softc *tp) { struct ifnet *ifp = tp->tap_ifp; - /* Unlocked read. */ - KASSERT(!(tp->tap_flags & TAP_OPEN), - ("%s flags is out of sync", ifp->if_xname)); - CURVNET_SET(ifp->if_vnet); + destroy_dev(tp->tap_dev); seldrain(&tp->tap_rsel); knlist_destroy(&tp->tap_rsel.si_note); - destroy_dev(tp->tap_dev); ether_ifdetach(ifp); if_free(ifp); diff --git a/sys/net/if_tapvar.h b/sys/net/if_tapvar.h index 21bac50..fb1c39a 100644 --- a/sys/net/if_tapvar.h +++ b/sys/net/if_tapvar.h @@ -64,6 +64,7 @@ struct tap_softc { SLIST_ENTRY(tap_softc) tap_next; /* next device in chain */ struct cdev *tap_dev; struct mtx tap_mtx; /* per-softc mutex */ + struct cv tap_cv; /* protect ref'd dev destroy */ }; #endif /* !_NET_IF_TAPVAR_H_ */ -- cgit v1.1