git: 29c08481e7d4 - stable/15 - pf: leave the epoch to purge unlinked rules

The branch stable/15 has been updated by rcm:

URL: https://cgit.FreeBSD.org/src/commit/?id=29c08481e7d4ca650ab13a365bb34a4326429643

commit 29c08481e7d4ca650ab13a365bb34a4326429643
Author:     R. Christian McDonald <rcm@FreeBSD.org>
AuthorDate: 2026-09-30 23:30:54 +0000
Commit:     R. Christian McDonald <rcm@FreeBSD.org>
CommitDate: 2026-10-28 20:34:04 +0000

    pf: leave the epoch to purge unlinked rules
    
    pf_purge_thread() calls pf_purge_unlinked_rules() in the network
    epoch, where sleeping is not allowed, and it takes pf_config_lock, an
    sx lock. If a rule is being added at the time, the purge thread
    can sleep on the lock, which panics with INVARIANTS.
    
    Reviewed by:            kp
    Approved by:            kp (mentor)
    Fixes:                  f92d9b1aad73 ("pflow: import from OpenBSD")
    MFC after:              1 week
    Sponsored by:           Rubicon Communications, LLC ("Netgate")
    Differential Revision:  https://reviews.freebsd.org/D60160
    
    (cherry picked from commit 82ab4adec95578b196eaf431d6ca87dd209aca6b)
---
 sys/netpfil/pf/pf.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c
index 8c2b905b4ba0..b710c15085d6 100644
--- a/sys/netpfil/pf/pf.c
+++ b/sys/netpfil/pf/pf.c
@@ -2689,7 +2689,13 @@ pf_purge_thread(void *unused __unused)
 				 */
 				pf_purge_expired_fragments();
 				pf_purge_expired_src_nodes();
+				/*
+				 * Takes the config lock, and may have to
+				 * sleep for it.
+				 */
+				NET_EPOCH_EXIT(et);
 				pf_purge_unlinked_rules();
+				NET_EPOCH_ENTER(et);
 				pfi_kkif_purge();
 			}
 			CURVNET_RESTORE();