svn commit: r256008 - head/sys/net

[Gleb Smirnoff]

Author: glebius
Date: Wed Oct  2 20:44:36 2013
New Revision: 256008
URL: http://svnweb.freebsd.org/changeset/base/256008

Log:
  Clear knlist before destroying it in tap(4) and tun(4). This fixes later
  crash, when a kqueue descriptor tries to dereference appropriate knotes.
  
  Approved by:	re (kib)

Modified:
  head/sys/net/if_tap.c
  head/sys/net/if_tun.c

Modified: head/sys/net/if_tap.c
==============================================================================
--- head/sys/net/if_tap.c	Wed Oct  2 20:40:21 2013	(r256007)
+++ head/sys/net/if_tap.c	Wed Oct  2 20:44:36 2013	(r256008)
@@ -220,6 +220,7 @@ tap_destroy(struct tap_softc *tp)
 	CURVNET_SET(ifp->if_vnet);
 	destroy_dev(tp->tap_dev);
 	seldrain(&tp->tap_rsel);
+	knlist_clear(&tp->tap_rsel.si_note, 0);
 	knlist_destroy(&tp->tap_rsel.si_note);
 	ether_ifdetach(ifp);
 	if_free(ifp);

Modified: head/sys/net/if_tun.c
==============================================================================
--- head/sys/net/if_tun.c	Wed Oct  2 20:40:21 2013	(r256007)
+++ head/sys/net/if_tun.c	Wed Oct  2 20:44:36 2013	(r256008)
@@ -258,6 +258,7 @@ tun_destroy(struct tun_softc *tp)
 	if_free(TUN2IFP(tp));
 	destroy_dev(dev);
 	seldrain(&tp->tun_rsel);
+	knlist_clear(&tp->tun_rsel.si_note, 0);
 	knlist_destroy(&tp->tun_rsel.si_note);
 	mtx_destroy(&tp->tun_mtx);
 	cv_destroy(&tp->tun_cv);