From owner-svn-src-head@FreeBSD.ORG  Thu Dec 25 02:14:25 2008
Return-Path: <owner-svn-src-head@FreeBSD.ORG>
Delivered-To: svn-src-head@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id CCDA6106564A;
	Thu, 25 Dec 2008 02:14:25 +0000 (UTC)
	(envelope-from kmacy@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c])
	by mx1.freebsd.org (Postfix) with ESMTP id BA4BA8FC0C;
	Thu, 25 Dec 2008 02:14:25 +0000 (UTC)
	(envelope-from kmacy@FreeBSD.org)
Received: from svn.freebsd.org (localhost [127.0.0.1])
	by svn.freebsd.org (8.14.3/8.14.3) with ESMTP id mBP2EPNY000613;
	Thu, 25 Dec 2008 02:14:25 GMT (envelope-from kmacy@svn.freebsd.org)
Received: (from kmacy@localhost)
	by svn.freebsd.org (8.14.3/8.14.3/Submit) id mBP2EPgP000612;
	Thu, 25 Dec 2008 02:14:25 GMT (envelope-from kmacy@svn.freebsd.org)
Message-Id: <200812250214.mBP2EPgP000612@svn.freebsd.org>
From: Kip Macy <kmacy@FreeBSD.org>
Date: Thu, 25 Dec 2008 02:14:25 +0000 (UTC)
To: src-committers@freebsd.org, svn-src-all@freebsd.org,
	svn-src-head@freebsd.org
X-SVN-Group: head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Cc: 
Subject: svn commit: r186483 - head/sys/net
X-BeenThere: svn-src-head@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: SVN commit messages for the src tree for head/-current
	<svn-src-head.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/svn-src-head>,
	<mailto:svn-src-head-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-src-head>
List-Post: <mailto:svn-src-head@freebsd.org>
List-Help: <mailto:svn-src-head-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/svn-src-head>,
	<mailto:svn-src-head-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 25 Dec 2008 02:14:25 -0000

Author: kmacy
Date: Thu Dec 25 02:14:25 2008
New Revision: 186483
URL: http://svn.freebsd.org/changeset/base/186483

Log:
  - Close a race during which the open flag could be cleared but the tun_softc would still be referenced
    by adding a separate TUN_CLOSED flag that is set after tunclose is done referencing it.
  
  - drop the tun_mtx after the flag check to avoid holding it across if_detach which can recurse in to
    if_tun.c

Modified:
  head/sys/net/if_tun.c

Modified: head/sys/net/if_tun.c
==============================================================================
--- head/sys/net/if_tun.c	Thu Dec 25 01:59:44 2008	(r186482)
+++ head/sys/net/if_tun.c	Thu Dec 25 02:14:25 2008	(r186483)
@@ -79,6 +79,7 @@ struct tun_softc {
 #define	TUN_RWAIT	0x0040
 #define	TUN_ASYNC	0x0080
 #define	TUN_IFHEAD	0x0100
+#define	TUN_CLOSED	0x0200
 
 #define TUN_READY       (TUN_OPEN | TUN_INITED)
 
@@ -256,9 +257,11 @@ tun_destroy(struct tun_softc *tp)
 
 	/* Unlocked read. */
 	mtx_lock(&tp->tun_mtx);
-	if ((tp->tun_flags & TUN_OPEN) != 0)
+	if ((tp->tun_flags & (TUN_OPEN|TUN_CLOSED)) != TUN_CLOSED)
 		cv_wait_unlock(&tp->tun_cv, &tp->tun_mtx);
-
+	else
+		mtx_unlock(&tp->tun_mtx);
+	    
 	CURVNET_SET(TUN2IFP(tp)->if_vnet);
 	dev = tp->tun_dev;
 	bpfdetach(TUN2IFP(tp));
@@ -497,6 +500,7 @@ tunclose(struct cdev *dev, int foo, int 
 	KNOTE_UNLOCKED(&tp->tun_rsel.si_note, 0);
 	TUNDEBUG (ifp, "closed\n");
 
+	tp->tun_flags |= TUN_CLOSED;
 	cv_broadcast(&tp->tun_cv);
 	mtx_unlock(&tp->tun_mtx);
 	return (0);