Hello, The issue has been found by Chris Cappuccio. The good news is it can not be triggered by default. To trigger the bug one has to build kernel with 'WITH_PF_LOCK' option. PF_STATE_ENTER_WRITE(), which is no-op by default, becomes operational, when WITH_PF_LOCK is defined.
the 'pfctl -L state.file' loads states from file to PF driver. It uses pfsync_state_import(). The pfsync_state_import() takes care of state table locking, thus pfioctl() (the caller) should not bother. OK? thanks and regards sashan --------8<---------------8<---------------8<------------------8<-------- diff --git a/sys/net/pf_ioctl.c b/sys/net/pf_ioctl.c index e1810afe156..8060d605ea9 100644 --- a/sys/net/pf_ioctl.c +++ b/sys/net/pf_ioctl.c @@ -1682,9 +1682,7 @@ pfioctl(dev_t dev, u_long cmd, caddr_t addr, int flags, struct proc *p) break; } PF_LOCK(); - PF_STATE_ENTER_WRITE(); error = pfsync_state_import(sp, PFSYNC_SI_IOCTL); - PF_STATE_EXIT_WRITE(); PF_UNLOCK(); break; }