From c7063c15b02b0519293ebd5ca24bb7f1cd2cca8b Mon Sep 17 00:00:00 2001 From: Gleb Smirnoff Date: Wed, 2 Oct 2013 20:44:36 +0000 Subject: [PATCH] Clear knlist before destroying it in tap(4) and tun(4). This fixes later crash, when a kqueue descriptor tries to dereference appropriate knotes. Approved by: re (kib) --- sys/net/if_tap.c | 1 + sys/net/if_tun.c | 1 + 2 files changed, 2 insertions(+) diff --git a/sys/net/if_tap.c b/sys/net/if_tap.c index ad6f781b6e5..fe53a6acf4f 100644 --- a/sys/net/if_tap.c +++ b/sys/net/if_tap.c @@ -220,6 +220,7 @@ tap_destroy(struct tap_softc *tp) CURVNET_SET(ifp->if_vnet); destroy_dev(tp->tap_dev); seldrain(&tp->tap_rsel); + knlist_clear(&tp->tap_rsel.si_note, 0); knlist_destroy(&tp->tap_rsel.si_note); ether_ifdetach(ifp); if_free(ifp); diff --git a/sys/net/if_tun.c b/sys/net/if_tun.c index f44bc0e5bf3..f36e7ada3d2 100644 --- a/sys/net/if_tun.c +++ b/sys/net/if_tun.c @@ -258,6 +258,7 @@ tun_destroy(struct tun_softc *tp) if_free(TUN2IFP(tp)); destroy_dev(dev); seldrain(&tp->tun_rsel); + knlist_clear(&tp->tun_rsel.si_note, 0); knlist_destroy(&tp->tun_rsel.si_note); mtx_destroy(&tp->tun_mtx); cv_destroy(&tp->tun_cv);