svn commit: r240938 - head/sys/net

[Konstantin Belousov]

On Tue, Sep 25, 2012 at 10:10:14PM +0000, Ed Maste wrote:
> Author: emaste
> Date: Tue Sep 25 22:10:14 2012
> New Revision: 240938
> URL: http://svn.freebsd.org/changeset/base/240938
> 
> Log:
>   Avoid INVARIANTS panic destroying an in-use tap(4)
>   
>   The requirement (implied by the KASSERT in tap_destroy) that the tap is
>   closed isn't valid; destroy_dev will block in devdrn while other threads
>   are in d_* functions.
Are you sure ?

The device may be opened, but no threads could be in any cdevsw
methods. destroy_dev(9) only waits for threads to leave cdevsw methods,
and not for the close to happen.

This is normal situation, but driver shall be aware of it and
handle it properly.

>   
>   Note: if_tun had the same issue, addressed in SVN revisions r186391,
>   r186483 and r186497.  The use of the condvar there appears to be
>   redundant with the functionality provided by destroy_dev.
>   
>   Sponsored by:	ADARA Networks
>   Reviewed by:	dwhite
>   MFC after:	2 weeks
> 
> Modified:
>   head/sys/net/if_tap.c
>   head/sys/net/if_tapvar.h
> 
> Modified: head/sys/net/if_tap.c
> ==============================================================================
> --- head/sys/net/if_tap.c	Tue Sep 25 21:33:36 2012	(r240937)
> +++ head/sys/net/if_tap.c	Tue Sep 25 22:10:14 2012	(r240938)
> @@ -213,14 +213,10 @@ tap_destroy(struct tap_softc *tp)
>  {
>  	struct ifnet *ifp = tp->tap_ifp;
>  
> -	/* Unlocked read. */
> -	KASSERT(!(tp->tap_flags & TAP_OPEN),
> -		("%s flags is out of sync", ifp->if_xname));
> -
>  	CURVNET_SET(ifp->if_vnet);
> +	destroy_dev(tp->tap_dev);
>  	seldrain(&tp->tap_rsel);
>  	knlist_destroy(&tp->tap_rsel.si_note);
> -	destroy_dev(tp->tap_dev);
>  	ether_ifdetach(ifp);
>  	if_free(ifp);
>  
> 
> Modified: head/sys/net/if_tapvar.h
> ==============================================================================
> --- head/sys/net/if_tapvar.h	Tue Sep 25 21:33:36 2012	(r240937)
> +++ head/sys/net/if_tapvar.h	Tue Sep 25 22:10:14 2012	(r240938)
> @@ -64,6 +64,7 @@ struct tap_softc {
>  	SLIST_ENTRY(tap_softc)	tap_next;	/* next device in chain      */
>  	struct cdev *tap_dev;
>  	struct mtx	 tap_mtx;		/* per-softc mutex */
> +	struct cv	 tap_cv;		/* protect ref'd dev destroy */ 
>  };
>  
>  #endif /* !_NET_IF_TAPVAR_H_ */
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 196 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/svn-src-all/attachments/20120926/acf57c4e/attachment.pgp