diff options
| author | Kristof Provost <kp@FreeBSD.org> | 2025-12-01 21:30:56 +0000 |
|---|---|---|
| committer | Kristof Provost <kp@FreeBSD.org> | 2025-12-08 09:34:20 +0000 |
| commit | 9b2551051fce2b56bcc8f4d03596205225d5832b (patch) | |
| tree | 816a3540baf4e70d54d65df51465564ce02d960d | |
| parent | ef8a5af2a3ec6ae1ade610ce0c33298eb6cd3bae (diff) | |
pfsync: fix incorrect unlock during destroy
During pfsync_clone_destroy() we clean up pending packets. This
may involve calling pfsync_undefer() or callout_drain(). We may not
hold the bucket lock during callout_drain(), but must hold it during
pfsync_undefer().
We incorrectly always released the lock, leading to assertion failures
during cleanup if there were pending deferred packets.
MFC after: 1 week
Sponsored by: Orange Business Services
(cherry picked from commit 639e65144aa71cb03b5431861803f528308760dc)
| -rw-r--r-- | sys/netpfil/pf/if_pfsync.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sys/netpfil/pf/if_pfsync.c b/sys/netpfil/pf/if_pfsync.c index c43cb59d8705..cc5b62d47df3 100644 --- a/sys/netpfil/pf/if_pfsync.c +++ b/sys/netpfil/pf/if_pfsync.c @@ -402,13 +402,13 @@ pfsync_clone_destroy(struct ifnet *ifp) TAILQ_FIRST(&b->b_deferrals); ret = callout_stop(&pd->pd_tmo); - PFSYNC_BUCKET_UNLOCK(b); if (ret > 0) { pfsync_undefer(pd, 1); } else { + PFSYNC_BUCKET_UNLOCK(b); callout_drain(&pd->pd_tmo); + PFSYNC_BUCKET_LOCK(b); } - PFSYNC_BUCKET_LOCK(b); } MPASS(b->b_deferred == 0); MPASS(TAILQ_EMPTY(&b->b_deferrals)); |