Author: kp
Date: Sat Jul 14 09:11:32 2018
New Revision: 336273
URL: https://svnweb.freebsd.org/changeset/base/336273
Log:
pf: Fix panic on vnet jail shutdown with synproxy
When shutting down a vnet jail pf_shutdown() clears the remaining states,
which
through pf_clear_states() calls pf_unlink_state().
For synproxy states pf_unlink_state() will send a TCP RST, which eventually
tries to schedule the pf swi in pf_send(). This means we can't remove the
software interrupt until after pf_shutdown().
MFC after: 1 week
Modified:
head/sys/netpfil/pf/pf_ioctl.c
Modified: head/sys/netpfil/pf/pf_ioctl.c
==============================================================================
--- head/sys/netpfil/pf/pf_ioctl.c Sat Jul 14 06:43:37 2018
(r336272)
+++ head/sys/netpfil/pf/pf_ioctl.c Sat Jul 14 09:11:32 2018
(r336273)
@@ -3951,7 +3951,6 @@ pf_unload_vnet(void)
V_pf_vnet_active = 0;
V_pf_status.running = 0;
- swi_remove(V_pf_swi_cookie);
error = dehook_pf();
if (error) {
/*
@@ -3966,6 +3965,8 @@ pf_unload_vnet(void)
PF_RULES_WLOCK();
shutdown_pf();
PF_RULES_WUNLOCK();
+
+ swi_remove(V_pf_swi_cookie);
pf_unload_vnet_purge();
_______________________________________________
[email protected] mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "[email protected]"
