HomeFreeBSD

if_tuntap: Try to fix device refcount bugs

Description

if_tuntap: Try to fix device refcount bugs

There are two ways to create a tun device, via devfs cloning or with
ifconfig. The latter is implemented by tun_clone_create() and the
former by tunclone(), which invokes tun_clone_create() via
if_clone_create(). Both of these functions were invoking dev_ref()
after creating the devfs_node(), but this was extraneous. tunclone()
does need to acquire an extra reference since this is required by the
dev_clone EVENTHANDLER interface contract, but it was already doing so
by specifying MAKEDEV_REF. Fix this by removing unnecessary refcount
acquisitions.

A second problem is with teardown in a VNET jail. A tun interface
created by device cloning will hold a credential reference for the jail,
which prevents it from being destroyed and in particular prevents VNET
SYSUNINITs from running. To fix this, we need to register a
PR_METHOD_REMOVE callback for jail teardown which, in a VNET jail,
destroys cloned interfaces. This way, jail teardown can proceed.

These bugs are noticeable with something like

  1. jail -c name=test vnet command=ls /dev/tun
  2. jls -vd

While here, add some comments and be sure to destroy a nascent mutex and
condition variable in an error path.

Reviewed by: kib
MFC after: 1 month
Sponsored by: Stormshield
Sponsored by: Klara, Inc.
Differential Revision: https://reviews.freebsd.org/D51525

Details

Provenance
markjAuthored on Jul 28 2025, 4:03 PM
Reviewer
kib
Differential Revision
D51525: if_tuntap: Try to fix device refcount bugs
Parents
rG96b29c7f0cff: if_ovpn: Destroy cloned interfaces via a prison removal callback
Branches
Unknown
Tags
Unknown