svn commit: r336273 - head/sys/netpfil/pf

[Kristof Provost]

Author: kp
Date: Sat Jul 14 09:11:32 2018
New Revision: 336273
URL: https://svnweb.freebsd.org/changeset/base/336273

Log:
  pf: Fix panic on vnet jail shutdown with synproxy
  
  When shutting down a vnet jail pf_shutdown() clears the remaining states, which
  through pf_clear_states() calls pf_unlink_state().
  For synproxy states pf_unlink_state() will send a TCP RST, which eventually
  tries to schedule the pf swi in pf_send(). This means we can't remove the
  software interrupt until after pf_shutdown().
  
  MFC after:	1 week

Modified:
  head/sys/netpfil/pf/pf_ioctl.c

Modified: head/sys/netpfil/pf/pf_ioctl.c
==============================================================================
--- head/sys/netpfil/pf/pf_ioctl.c	Sat Jul 14 06:43:37 2018	(r336272)
+++ head/sys/netpfil/pf/pf_ioctl.c	Sat Jul 14 09:11:32 2018	(r336273)
@@ -3951,7 +3951,6 @@ pf_unload_vnet(void)
 
 	V_pf_vnet_active = 0;
 	V_pf_status.running = 0;
-	swi_remove(V_pf_swi_cookie);
 	error = dehook_pf();
 	if (error) {
 		/*
@@ -3966,6 +3965,8 @@ pf_unload_vnet(void)
 	PF_RULES_WLOCK();
 	shutdown_pf();
 	PF_RULES_WUNLOCK();
+
+	swi_remove(V_pf_swi_cookie);
 
 	pf_unload_vnet_purge();