From owner-svn-src-all@FreeBSD.ORG Sun Feb 28 16:25:49 2010 Return-Path: Delivered-To: svn-src-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 9BAEC106566B; Sun, 28 Feb 2010 16:25:49 +0000 (UTC) (envelope-from kib@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c]) by mx1.freebsd.org (Postfix) with ESMTP id 808308FC1C; Sun, 28 Feb 2010 16:25:49 +0000 (UTC) Received: from svn.freebsd.org (localhost [127.0.0.1]) by svn.freebsd.org (8.14.3/8.14.3) with ESMTP id o1SGPnmQ030130; Sun, 28 Feb 2010 16:25:49 GMT (envelope-from kib@svn.freebsd.org) Received: (from kib@localhost) by svn.freebsd.org (8.14.3/8.14.3/Submit) id o1SGPnh1030127; Sun, 28 Feb 2010 16:25:49 GMT (envelope-from kib@svn.freebsd.org) Message-Id: <201002281625.o1SGPnh1030127@svn.freebsd.org> From: Konstantin Belousov Date: Sun, 28 Feb 2010 16:25:49 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cc: Subject: svn commit: r204464 - head/sys/net X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 28 Feb 2010 16:25:49 -0000 Author: kib Date: Sun Feb 28 16:25:49 2010 New Revision: 204464 URL: http://svn.freebsd.org/changeset/base/204464 Log: In both if_tun and if_tap: Do not do additional dev_ref() on the newly created interface in the if_clone create method [1]. This reference is not needed and never removed, causing struct cdevpriv leakage. Remove the setting of SI_CHEAPCLONE flag as well, since it is unused. For dev_clone handlers, create cdevs with the call make_dev_credf(MAKEDEV_REF) instead of calling make_dev() and then dev_ref(), to avoid a race. Call drain_dev_clone_events() at the module unload time after dev_clone handler is deinstalled. Submitted by: Mikolaj Golub [1] MFC after: 1 week Modified: head/sys/net/if_tap.c head/sys/net/if_tun.c Modified: head/sys/net/if_tap.c ============================================================================== --- head/sys/net/if_tap.c Sun Feb 28 16:14:34 2010 (r204463) +++ head/sys/net/if_tap.c Sun Feb 28 16:25:49 2010 (r204464) @@ -192,10 +192,6 @@ tap_clone_create(struct if_clone *ifc, i if (i) { dev = make_dev(&tap_cdevsw, unit | extra, UID_ROOT, GID_WHEEL, 0600, "%s%d", ifc->ifc_name, unit); - if (dev != NULL) { - dev_ref(dev); - dev->si_flags |= SI_CHEAPCLONE; - } } tapcreate(dev); @@ -300,6 +296,7 @@ tapmodevent(module_t mod, int type, void EVENTHANDLER_DEREGISTER(dev_clone, eh_tag); if_clone_detach(&tap_cloner); if_clone_detach(&vmnet_cloner); + drain_dev_clone_events(); mtx_lock(&tapmtx); while ((tp = SLIST_FIRST(&taphead)) != NULL) { @@ -381,12 +378,8 @@ tapclone(void *arg, struct ucred *cred, name = devname; } - *dev = make_dev(&tap_cdevsw, unit | extra, - UID_ROOT, GID_WHEEL, 0600, "%s", name); - if (*dev != NULL) { - dev_ref(*dev); - (*dev)->si_flags |= SI_CHEAPCLONE; - } + *dev = make_dev_credf(MAKEDEV_REF, &tap_cdevsw, unit | extra, + cred, UID_ROOT, GID_WHEEL, 0600, "%s", name); } if_clone_create(name, namelen, NULL); Modified: head/sys/net/if_tun.c ============================================================================== --- head/sys/net/if_tun.c Sun Feb 28 16:14:34 2010 (r204463) +++ head/sys/net/if_tun.c Sun Feb 28 16:25:49 2010 (r204464) @@ -188,10 +188,6 @@ tun_clone_create(struct if_clone *ifc, i /* No preexisting struct cdev *, create one */ dev = make_dev(&tun_cdevsw, unit, UID_UUCP, GID_DIALER, 0600, "%s%d", ifc->ifc_name, unit); - if (dev != NULL) { - dev_ref(dev); - dev->si_flags |= SI_CHEAPCLONE; - } } tuncreate(ifc->ifc_name, dev); @@ -237,12 +233,8 @@ tunclone(void *arg, struct ucred *cred, name = devname; } /* No preexisting struct cdev *, create one */ - *dev = make_dev(&tun_cdevsw, u, + *dev = make_dev_credf(MAKEDEV_REF, &tun_cdevsw, u, cred, UID_UUCP, GID_DIALER, 0600, "%s", name); - if (*dev != NULL) { - dev_ref(*dev); - (*dev)->si_flags |= SI_CHEAPCLONE; - } } if_clone_create(name, namelen, NULL); @@ -303,6 +295,7 @@ tunmodevent(module_t mod, int type, void case MOD_UNLOAD: if_clone_detach(&tun_cloner); EVENTHANDLER_DEREGISTER(dev_clone, tag); + drain_dev_clone_events(); mtx_lock(&tunmtx); while ((tp = TAILQ_FIRST(&tunhead)) != NULL) {