kern/116837: [tun] [panic] [patch] ifconfig tunX destroy: panic

[KUROSAWA Takahiro]

The following reply was made to PR kern/116837; it has been noted by GNATS.

From: KUROSAWA Takahiro <fwkg7679 at mb.infoweb.ne.jp>
To: bug-followup at FreeBSD.org, bvanzant at ironport.com, jkpyvxmzsa at mailinator.com
Cc:  
Subject: Re: kern/116837: [tun] [panic] [patch] ifconfig tunX destroy: panic
Date: Tue, 5 Feb 2008 12:58:31 +0900

 It seems that lackness of waking up a process sleeping on select(2)
 caused the panic.  The following patch (instead of the previous one)
 might fix the problem.
 
 --- sys/net/if_tun.c	2008/01/11 04:14:11	1.1
 +++ sys/net/if_tun.c	2008/01/29 02:22:43
 @@ -249,15 +249,16 @@ tun_destroy(struct tun_softc *tp)
  {
  	struct cdev *dev;
  
 -	/* Unlocked read. */
 -	KASSERT((tp->tun_flags & TUN_OPEN) == 0,
 -	    ("tununits is out of sync - unit %d", TUN2IFP(tp)->if_dunit));
 -
  	dev = tp->tun_dev;
 +	/* destroy_dev() ensures no threads access /dev/tunX anymore. */
 +	destroy_dev(dev);
  	bpfdetach(TUN2IFP(tp));
  	if_detach(TUN2IFP(tp));
  	if_free(TUN2IFP(tp));
 -	destroy_dev(dev);
 +
 +	funsetown(&tp->tun_sigio);
 +	selwakeuppri(&tp->tun_rsel, PZERO + 1);
 +	KNOTE_UNLOCKED(&tp->tun_rsel.si_note, 0);
  	knlist_destroy(&tp->tun_rsel.si_note);
  	mtx_destroy(&tp->tun_mtx);
  	free(tp, M_TUN);