bpf: don't clear pointer from descriptor to the tap on descriptor close

[glebius]

Summary

During packet processing the descriptor is looked up using epoch(9) and it
can be accessed after bpf_detachd(). In scenario of descriptor close the
tap point is alive (it actually produces packets) and thus the pointer can
be legitimately dereferenced. This fixes a race on a bpf(4) device close
that would otherwise result in panic.

[zlei]

Is bpf_chkdir() dereferencing a NULL d->bd_bif in net epoch ?

bpfwrite() is locked checking d->bd_bif == NULL and returns ENXIO incase true, and if not, will bpfwrite() then possibly reference a freed bpf_if ?