Do not call knlist_destroy() in tapclose(). Instead call it when device is

actually destroyed. Also move call to knlist_init() into tapcreate(). This
should fix panic described in kern/95357.

PR:			kern/95357
No response from:	freebsd-current@
MFC after:		3 days

1 files changed, 3 insertions, 4 deletions

diff --git a/sys/net/if_tap.c b/sys/net/if_tap.c
index 62b7241dd191..78baf035080c 100644
--- a/sys/net/if_tap.c
+++ b/sys/net/if_tap.c
@@ -219,6 +219,7 @@ tapmodevent(module_t mod, int type, void *data)
 			KASSERT(!(tp->tap_flags & TAP_OPEN), 
 				("%s flags is out of sync", ifp->if_xname));
 
+			knlist_destroy(&tp->tap_rsel.si_note);
 			destroy_dev(tp->tap_dev);
 			s = splimp();
 			ether_ifdetach(ifp);
@@ -354,6 +355,8 @@ tapcreate(struct cdev *dev)
 	tp->tap_flags |= TAP_INITED;
 	mtx_unlock(&tp->tap_mtx);
 
+	knlist_init(&tp->tap_rsel.si_note, NULL, NULL, NULL, NULL);
+
 	TAPDEBUG("interface %s is created. minor = %#x\n", 
 		ifp->if_xname, minor(dev));
 } /* tapcreate */
@@ -405,8 +408,6 @@ tapopen(struct cdev *dev, int flag, int mode, struct thread *td)
 	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
 	splx(s);
 
-	knlist_init(&tp->tap_rsel.si_note, NULL, NULL, NULL, NULL);
-
 	TAPDEBUG("%s is open. minor = %#x\n", ifp->if_xname, minor(dev));
 
 	return (0);
@@ -459,8 +460,6 @@ tapclose(struct cdev *dev, int foo, int bar, struct thread *td)
 	tp->tap_pid = 0;
 	mtx_unlock(&tp->tap_mtx);
 
-	knlist_destroy(&tp->tap_rsel.si_note);
-
 	TAPDEBUG("%s is closed. minor = %#x\n", 
 		ifp->if_xname, minor(dev));