svn commit: r348126 - stable/11/sys/net

[Kyle Evans]

Author: kevans
Date: Wed May 22 22:56:05 2019
New Revision: 348126
URL: https://svnweb.freebsd.org/changeset/base/348126

Log:
  MFC r347578: tun/tap: Defer clearing if_softc until after if_detach
  
  (Commit massaged to match stable structure; tun and tap have been merged in
  head)
  
  r346670 added an sx to close a race between the ifioctl handler and
  interface destruction. Unfortunately, it clears if_softc immediately after
  the interface is closed, but before if_detach has been invoked.
  
  Any time before detachment, an interface that's part of a bridge may still
  receive traffic that's pushed through tunstart/tunstart_l2 and promptly
  lead to a panic because if_softc is now NULL.
  
  Fix it by deferring the clearing of if_softc until after the interface has
  detached and thus been removed from the bridge. if_softc still gets cleared
  in case another thread has already entered the ioctl handler before it's
  replaced with ifdead_ioctl.
  
  Approved by:	re (kib)

Modified:
  stable/11/sys/net/if_tap.c
  stable/11/sys/net/if_tun.c
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/sys/net/if_tap.c
==============================================================================
--- stable/11/sys/net/if_tap.c	Wed May 22 22:55:27 2019	(r348125)
+++ stable/11/sys/net/if_tap.c	Wed May 22 22:56:05 2019	(r348126)
@@ -223,15 +223,17 @@ tap_destroy(struct tap_softc *tp)
 	struct ifnet *ifp = tp->tap_ifp;
 
 	CURVNET_SET(ifp->if_vnet);
-	sx_xlock(&tap_ioctl_sx);
-	ifp->if_softc = NULL;
-	sx_xunlock(&tap_ioctl_sx);
 
 	destroy_dev(tp->tap_dev);
 	seldrain(&tp->tap_rsel);
 	knlist_clear(&tp->tap_rsel.si_note, 0);
 	knlist_destroy(&tp->tap_rsel.si_note);
 	ether_ifdetach(ifp);
+
+	sx_xlock(&tap_ioctl_sx);
+	ifp->if_softc = NULL;
+	sx_xunlock(&tap_ioctl_sx);
+
 	if_free(ifp);
 
 	mtx_destroy(&tp->tap_mtx);

Modified: stable/11/sys/net/if_tun.c
==============================================================================
--- stable/11/sys/net/if_tun.c	Wed May 22 22:55:27 2019	(r348125)
+++ stable/11/sys/net/if_tun.c	Wed May 22 22:56:05 2019	(r348126)
@@ -278,13 +278,15 @@ tun_destroy(struct tun_softc *tp)
 		mtx_unlock(&tp->tun_mtx);
 
 	CURVNET_SET(TUN2IFP(tp)->if_vnet);
-	sx_xlock(&tun_ioctl_sx);
-	TUN2IFP(tp)->if_softc = NULL;
-	sx_xunlock(&tun_ioctl_sx);
 
 	dev = tp->tun_dev;
 	bpfdetach(TUN2IFP(tp));
 	if_detach(TUN2IFP(tp));
+
+	sx_xlock(&tun_ioctl_sx);
+	TUN2IFP(tp)->if_softc = NULL;
+	sx_xunlock(&tun_ioctl_sx);
+
 	free_unr(tun_unrhdr, TUN2IFP(tp)->if_dunit);
 	if_free(TUN2IFP(tp));
 	destroy_dev(dev);