When running user-mode linux on 2.6.0-test3, sometimes the TAP device
cannot be correctly removed when someone request to delete it, by
closing /dev/net/tun after setting TUNSETPERSIST to 0.  The message
is:

unregister_netdevice: waiting for tap0 to become free.  Usage count = 1

The message repeats forever, system time is 100%, related processes
are all in D state, ifconfig locks up, and the system cannot be shut down
normally (can only use Alt-Sysrq-SUB).

Looks like a refcount leak.  Maybe it is IPv6 related since without
setting IPv6 routes to the tap device there seems to be no problem,
but I'm not sure of that.

By the way, I think creation and removal of netdevices should be done
in a mount-like manner, which means that they are persistent
(originally non-persistent tap devices should just be removed
automatically when they are no longer used), can be removed by hand,
and if they are being used -EBUSY should be returned.

What I did run:

1. Run "tunctl", which just creates a persistent tap0 device.

2. Run the attached script that starts UML.  I guess it is enough to
just look at the "route", "ip" and "arp" commands.  The UML process
just provides the data for the tunnel.

Running it several times is also okay, I didn't see any higher
reference counts.

3. Run "tunctl -d tap0" which sets tap0 as non-persistent, thus it will
be removed.  The command locks up, and the aforementioned message then
appears.

I may be able to make the problem more reproducible, but it takes many
reboots so I want to ask for your advice first.

I'm not a subscriber, please CC me.