git: c730caf617d7 - stable/14 - pf: Drain the overload task before a vnet's rules are freed

The branch stable/14 has been updated by rcm:

URL: https://cgit.FreeBSD.org/src/commit/?id=c730caf617d74422010472a66a4d8abd68a2c03e

commit c730caf617d74422010472a66a4d8abd68a2c03e
Author:     R. Christian McDonald <rcm@FreeBSD.org>
AuthorDate: 2026-10-12 11:52:34 +0000
Commit:     R. Christian McDonald <rcm@FreeBSD.org>
CommitDate: 2026-10-28 20:38:07 +0000

    pf: Drain the overload task before a vnet's rules are freed
    
    pf_src_connlimit() queues an entry for pf_overload_task() when a
    source exceeds max-src-conn or max-src-conn-rate and the rule has an
    overload table.  The entry holds a pointer to the rule, and the task
    runs from taskqueue_swi with the vnet of the queue.  Nothing drained
    the task when the vnet went away: an entry queued just before could
    be applied to a rule pf_unload_vnet_purge() had freed, or to a vnet
    that was gone.
    
    Drain the task at the start of pf_unload_vnet_purge(), before the
    unlinked rules are freed.  No packet can queue another by then, as the
    hooks are already removed.
    
    Reviewed by:            kp
    MFC after:              2 weeks
    Sponsored by:           Rubicon Communications, LLC ("Netgate")
    Differential Revision:  https://reviews.freebsd.org/D60529
    
    (cherry picked from commit 92d66a6b474fa6fe42fbe08002803d79a5af6594)
---
 sys/netpfil/pf/pf.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c
index 7c1f43a8b9bd..9cd1c2897cb3 100644
--- a/sys/netpfil/pf/pf.c
+++ b/sys/netpfil/pf/pf.c
@@ -2261,6 +2261,9 @@ void
 pf_unload_vnet_purge(void)
 {
 
+	/* Overload entries reference rules: apply them before rules are freed. */
+	taskqueue_drain(taskqueue_swi, &V_pf_overloadtask);
+
 	/*
 	 * To cleanse up all kifs and rules we need
 	 * two runs: first one clears reference flags,