svn commit: r336576 - stable/11/sys/netpfil/pf

[Kristof Provost]

Author: kp
Date: Sat Jul 21 07:50:46 2018
New Revision: 336576
URL: https://svnweb.freebsd.org/changeset/base/336576

Log:
  MFC r336273:
  
  pf: Fix panic on vnet jail shutdown with synproxy
  
  When shutting down a vnet jail pf_shutdown() clears the remaining states, which
  through pf_clear_states() calls pf_unlink_state().
  For synproxy states pf_unlink_state() will send a TCP RST, which eventually
  tries to schedule the pf swi in pf_send(). This means we can't remove the
  software interrupt until after pf_shutdown().

Modified:
  stable/11/sys/netpfil/pf/pf_ioctl.c
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/sys/netpfil/pf/pf_ioctl.c
==============================================================================
--- stable/11/sys/netpfil/pf/pf_ioctl.c	Sat Jul 21 07:00:21 2018	(r336575)
+++ stable/11/sys/netpfil/pf/pf_ioctl.c	Sat Jul 21 07:50:46 2018	(r336576)
@@ -3938,7 +3938,6 @@ pf_unload_vnet(void)
 
 	V_pf_vnet_active = 0;
 	V_pf_status.running = 0;
-	swi_remove(V_pf_swi_cookie);
 	error = dehook_pf();
 	if (error) {
 		/*
@@ -3955,6 +3954,8 @@ pf_unload_vnet(void)
 	PF_RULES_WLOCK();
 	shutdown_pf();
 	PF_RULES_WUNLOCK();
+
+	swi_remove(V_pf_swi_cookie);
 
 	pf_normalize_cleanup();
 	PF_RULES_WLOCK();