git: 92d66a6b474f - main - pf: Drain the overload task before a vnet's rules are freed

The branch main has been updated by rcm:

URL: https://cgit.FreeBSD.org/src/commit/?id=92d66a6b474fa6fe42fbe08002803d79a5af6594

commit 92d66a6b474fa6fe42fbe08002803d79a5af6594
Author:     R. Christian McDonald <rcm@FreeBSD.org>
AuthorDate: 2026-10-12 11:52:34 +0000
Commit:     R. Christian McDonald <rcm@FreeBSD.org>
CommitDate: 2026-10-12 11:52:34 +0000

    pf: Drain the overload task before a vnet's rules are freed
    
    pf_src_connlimit() queues an entry for pf_overload_task() when a
    source exceeds max-src-conn or max-src-conn-rate and the rule has an
    overload table.  The entry holds a pointer to the rule, and the task
    runs from taskqueue_swi with the vnet of the queue.  Nothing drained
    the task when the vnet went away: an entry queued just before could
    be applied to a rule pf_unload_vnet_purge() had freed, or to a vnet
    that was gone.
    
    Drain the task at the start of pf_unload_vnet_purge(), before the
    unlinked rules are freed.  No packet can queue another by then, as the
    hooks are already removed.
    
    Reviewed by:            kp
    MFC after:              2 weeks
    Sponsored by:           Rubicon Communications, LLC ("Netgate")
    Differential Revision:  https://reviews.freebsd.org/D60529
---
 sys/netpfil/pf/pf.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c
index d125a28a5b76..3dcb0c29e62a 100644
--- a/sys/netpfil/pf/pf.c
+++ b/sys/netpfil/pf/pf.c
@@ -2960,6 +2960,9 @@ void
 pf_unload_vnet_purge(void)
 {
 
+	/* Overload entries reference rules: apply them before rules are freed. */
+	taskqueue_drain(taskqueue_swi, &V_pf_overloadtask);
+
 	/*
 	 * To cleanse up all kifs and rules we need
 	 * two runs: first one clears reference flags,