MFC r326422:

  Do better cleaning in key_destroy() for VIMAGE case.

  SPDB was cleaned using TAILQ_CONCAT() instead of calling key_unlink()
  for each SP, thus we need to properly clean lists in each bucket of
  V_sphashtbl to avoid panic in hashdestroy() when INVARIANTS is enabled.

  Do the same for V_acqaddrhashtbl and V_acqseqhashtbl.

  When we are called in DEFAULT_VNET, destroy also all global locks and
  drain key_timer callout.

  Reported by:	kp
  Tested by:	kp

(cherry picked from commit 0925361361d574d82f00033397972226eb5cac13)

1 files changed, 19 insertions, 0 deletions

diff --git a/sys/netipsec/key.c b/sys/netipsec/key.c
index 8cabbf6..a2de282 100644
--- a/sys/netipsec/key.c
+++ b/sys/netipsec/key.c
@@ -8129,7 +8129,10 @@ key_destroy(void)
 		TAILQ_CONCAT(&drainq, &V_sptree[i], chain);
 		TAILQ_CONCAT(&drainq, &V_sptree_ifnet[i], chain);
 	}
+	for (i = 0; i < V_sphash_mask + 1; i++)
+		LIST_INIT(&V_sphashtbl[i]);
 	SPTREE_WUNLOCK();
+
 	sp = TAILQ_FIRST(&drainq);
 	while (sp != NULL) {
 		nextsp = TAILQ_NEXT(sp, chain);
@@ -8180,6 +8183,10 @@ key_destroy(void)
 		free(acq, M_IPSEC_SAQ);
 		acq = nextacq;
 	}
+	for (i = 0; i < V_acqaddrhash_mask + 1; i++)
+		LIST_INIT(&V_acqaddrhashtbl[i]);
+	for (i = 0; i < V_acqseqhash_mask + 1; i++)
+		LIST_INIT(&V_acqseqhashtbl[i]);
 	ACQ_UNLOCK();
 
 	SPACQ_LOCK();
@@ -8195,6 +8202,18 @@ key_destroy(void)
 	hashdestroy(V_acqaddrhashtbl, M_IPSEC_SAQ, V_acqaddrhash_mask);
 	hashdestroy(V_acqseqhashtbl, M_IPSEC_SAQ, V_acqseqhash_mask);
 	uma_zdestroy(V_key_lft_zone);
+
+	if (!IS_DEFAULT_VNET(curvnet))
+		return;
+#ifndef IPSEC_DEBUG2
+	callout_drain(&key_timer);
+#endif
+	XFORMS_LOCK_DESTROY();
+	SPTREE_LOCK_DESTROY();
+	REGTREE_LOCK_DESTROY();
+	SAHTREE_LOCK_DESTROY();
+	ACQ_LOCK_DESTROY();
+	SPACQ_LOCK_DESTROY();
 }
 #endif