Author: kp
Date: Sat Jul 21 07:50:46 2018
New Revision: 336576
URL: https://svnweb.freebsd.org/changeset/base/336576
Log:
MFC r336273:
pf: Fix panic on vnet jail shutdown with synproxy
When shutting down a vnet jail pf_shutdown() clears the remaining states,
which
through pf_clear_states() calls pf_unlink_state().
For synproxy states pf_unlink_state() will send a TCP RST, which eventually
tries to schedule the pf swi in pf_send(). This means we can't remove the
software interrupt until after pf_shutdown().
Modified:
stable/11/sys/netpfil/pf/pf_ioctl.c
Directory Properties:
stable/11/ (props changed)
Modified: stable/11/sys/netpfil/pf/pf_ioctl.c
==============================================================================
--- stable/11/sys/netpfil/pf/pf_ioctl.c Sat Jul 21 07:00:21 2018
(r336575)
+++ stable/11/sys/netpfil/pf/pf_ioctl.c Sat Jul 21 07:50:46 2018
(r336576)
@@ -3938,7 +3938,6 @@ pf_unload_vnet(void)
V_pf_vnet_active = 0;
V_pf_status.running = 0;
- swi_remove(V_pf_swi_cookie);
error = dehook_pf();
if (error) {
/*
@@ -3955,6 +3954,8 @@ pf_unload_vnet(void)
PF_RULES_WLOCK();
shutdown_pf();
PF_RULES_WUNLOCK();
+
+ swi_remove(V_pf_swi_cookie);
pf_normalize_cleanup();
PF_RULES_WLOCK();
_______________________________________________
[email protected] mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "[email protected]"
