git: 82ab4adec955 - main - pf: leave the epoch to purge unlinked rules

The branch main has been updated by rcm:

URL: https://cgit.FreeBSD.org/src/commit/?id=82ab4adec95578b196eaf431d6ca87dd209aca6b

commit 82ab4adec95578b196eaf431d6ca87dd209aca6b
Author:     R. Christian McDonald <rcm@FreeBSD.org>
AuthorDate: 2026-09-30 23:30:54 +0000
Commit:     R. Christian McDonald <rcm@FreeBSD.org>
CommitDate: 2026-09-30 23:30:54 +0000

    pf: leave the epoch to purge unlinked rules
    
    pf_purge_thread() calls pf_purge_unlinked_rules() in the network
    epoch, where sleeping is not allowed, and it takes pf_config_lock, an
    sx lock. If a rule is being added at the time, the purge thread
    can sleep on the lock, which panics with INVARIANTS.
    
    Reviewed by:            kp
    Approved by:            kp (mentor)
    Fixes:                  f92d9b1aad73 ("pflow: import from OpenBSD")
    MFC after:              1 week
    Sponsored by:           Rubicon Communications, LLC ("Netgate")
    Differential Revision:  https://reviews.freebsd.org/D60160
---
 sys/netpfil/pf/pf.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c
index 73e6900ec6eb..d125a28a5b76 100644
--- a/sys/netpfil/pf/pf.c
+++ b/sys/netpfil/pf/pf.c
@@ -2935,7 +2935,13 @@ pf_purge_thread(void *unused __unused)
 				 */
 				pf_purge_expired_fragments();
 				pf_purge_expired_src_nodes();
+				/*
+				 * Takes the config lock, and may have to
+				 * sleep for it.
+				 */
+				NET_EPOCH_EXIT(et);
 				pf_purge_unlinked_rules();
+				NET_EPOCH_ENTER(et);
 				pf_source_purge();
 				pfi_kkif_purge();
 			}