kern/172075: panic if an in-use tap interface is destroyed

[Ed Maste]

>Number:         172075
>Category:       kern
>Synopsis:       panic if an in-use tap interface is destroyed
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Tue Sep 25 20:50:09 UTC 2012
>Closed-Date:
>Last-Modified:
>Originator:     Ed Maste
>Release:        FreeBSD 9.0-STABLE i386
>Organization:
FreeBSD
>Environment:
System: FreeBSD freefall.freebsd.org 9.0-STABLE FreeBSD 9.0-STABLE #6 r235139: Tue May 8 21:19:03 UTC 2012 simon at freefall.freebsd.org:/usr/obj/usr/src/sys/FREEFALL i386

>Description:

tap_destroy contains an assertion that the tap device
is not open, which causes a panic if attempting to
destroy that tap device.

   211  static void
   212  tap_destroy(struct tap_softc *tp)
   213  {
   214          struct ifnet *ifp = tp->tap_ifp;
   215  
   216          /* Unlocked read. */
   217          KASSERT(!(tp->tap_flags & TAP_OPEN),
   218                  ("%s flags is out of sync", ifp->if_xname));

>How-To-Repeat:

# ifconfig tap0 create
# cat /dev/tap0 &
# ifconfig tap0 destroy

>Fix:


>Release-Note:
>Audit-Trail:
>Unformatted: