From owner-freebsd-net@FreeBSD.ORG  Tue Feb  5 04:00:11 2008
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@hub.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 6084116A41A
	for <freebsd-net@hub.freebsd.org>; Tue,  5 Feb 2008 04:00:11 +0000 (UTC)
	(envelope-from gnats@FreeBSD.org)
Received: from freefall.freebsd.org (freefall.freebsd.org
	[IPv6:2001:4f8:fff6::28])
	by mx1.freebsd.org (Postfix) with ESMTP id 4FEF513C4DD
	for <freebsd-net@hub.freebsd.org>; Tue,  5 Feb 2008 04:00:11 +0000 (UTC)
	(envelope-from gnats@FreeBSD.org)
Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1])
	by freefall.freebsd.org (8.14.2/8.14.2) with ESMTP id m1540BlZ002325
	for <freebsd-net@freefall.freebsd.org>; Tue, 5 Feb 2008 04:00:11 GMT
	(envelope-from gnats@freefall.freebsd.org)
Received: (from gnats@localhost)
	by freefall.freebsd.org (8.14.2/8.14.1/Submit) id m1540Bxi002324;
	Tue, 5 Feb 2008 04:00:11 GMT (envelope-from gnats)
Date: Tue, 5 Feb 2008 04:00:11 GMT
Message-Id: <200802050400.m1540Bxi002324@freefall.freebsd.org>
To: freebsd-net@FreeBSD.org
From: KUROSAWA Takahiro <fwkg7679@mb.infoweb.ne.jp>
Cc: 
Subject: Re: kern/116837: [tun] [panic] [patch] ifconfig tunX destroy: panic
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
Reply-To: KUROSAWA Takahiro <fwkg7679@mb.infoweb.ne.jp>
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 05 Feb 2008 04:00:11 -0000

The following reply was made to PR kern/116837; it has been noted by GNATS.

From: KUROSAWA Takahiro <fwkg7679@mb.infoweb.ne.jp>
To: bug-followup@FreeBSD.org, bvanzant@ironport.com, jkpyvxmzsa@mailinator.com
Cc:  
Subject: Re: kern/116837: [tun] [panic] [patch] ifconfig tunX destroy: panic
Date: Tue, 5 Feb 2008 12:58:31 +0900

 It seems that lackness of waking up a process sleeping on select(2)
 caused the panic.  The following patch (instead of the previous one)
 might fix the problem.
 
 --- sys/net/if_tun.c	2008/01/11 04:14:11	1.1
 +++ sys/net/if_tun.c	2008/01/29 02:22:43
 @@ -249,15 +249,16 @@ tun_destroy(struct tun_softc *tp)
  {
  	struct cdev *dev;
  
 -	/* Unlocked read. */
 -	KASSERT((tp->tun_flags & TUN_OPEN) == 0,
 -	    ("tununits is out of sync - unit %d", TUN2IFP(tp)->if_dunit));
 -
  	dev = tp->tun_dev;
 +	/* destroy_dev() ensures no threads access /dev/tunX anymore. */
 +	destroy_dev(dev);
  	bpfdetach(TUN2IFP(tp));
  	if_detach(TUN2IFP(tp));
  	if_free(TUN2IFP(tp));
 -	destroy_dev(dev);
 +
 +	funsetown(&tp->tun_sigio);
 +	selwakeuppri(&tp->tun_rsel, PZERO + 1);
 +	KNOTE_UNLOCKED(&tp->tun_rsel.si_note, 0);
  	knlist_destroy(&tp->tun_rsel.si_note);
  	mtx_destroy(&tp->tun_mtx);
  	free(tp, M_TUN);