diff options
| author | bz <bz@FreeBSD.org> | 2016-06-23 22:31:10 +0000 |
|---|---|---|
| committer | bz <bz@FreeBSD.org> | 2016-06-23 22:31:10 +0000 |
| commit | 05bdc5790ff1c325d0ea778daa4ac1f76e806732 (patch) | |
| tree | ccb3de368acb88b09b96b7eeb5baabfe070a731c /sys/netpfil | |
| parent | 76dd3320a86e98bf68abbe4a1b7f46319c811386 (diff) | |
| download | FreeBSD-src-05bdc5790ff1c325d0ea778daa4ac1f76e806732.zip FreeBSD-src-05bdc5790ff1c325d0ea778daa4ac1f76e806732.tar.gz | |
Make sure pflog is attached after pf is initializaed so we can
borrow pf's lock, and also make sure pflog goes after pf is gone
in order to avoid callouts in VNETs to an already freed instance.
Reported by: Ivan Klymenko, Johan Hendriks on current@ today
Obtained from: projects/vnet
Sponsored by: The FreeBSD Foundation
MFC after: 13 days
Approved by: re (gjb)
Diffstat (limited to 'sys/netpfil')
| -rw-r--r-- | sys/netpfil/pf/if_pflog.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/sys/netpfil/pf/if_pflog.c b/sys/netpfil/pf/if_pflog.c index 6ea35b7..bf3b5f6 100644 --- a/sys/netpfil/pf/if_pflog.c +++ b/sys/netpfil/pf/if_pflog.c @@ -268,7 +268,7 @@ vnet_pflog_init(const void *unused __unused) pflogattach(1); } -VNET_SYSINIT(vnet_pflog_init, SI_SUB_PSEUDO, SI_ORDER_ANY, +VNET_SYSINIT(vnet_pflog_init, SI_SUB_PROTO_FIREWALL, SI_ORDER_ANY, vnet_pflog_init, NULL); static void @@ -277,6 +277,10 @@ vnet_pflog_uninit(const void *unused __unused) if_clone_detach(V_pflog_cloner); } +/* + * Detach after pf is gone; otherwise we might touch pflog memory + * from within pf after freeing pflog. + */ VNET_SYSUNINIT(vnet_pflog_uninit, SI_SUB_INIT_IF, SI_ORDER_SECOND, vnet_pflog_uninit, NULL); @@ -308,6 +312,7 @@ static moduledata_t pflog_mod = { pflogname, pflog_modevent, 0 }; #define PFLOG_MODVER 1 -DECLARE_MODULE(pflog, pflog_mod, SI_SUB_PSEUDO, SI_ORDER_ANY); +/* Do not run before pf is initialized as we depend on its locks. */ +DECLARE_MODULE(pflog, pflog_mod, SI_SUB_PROTO_FIREWALL, SI_ORDER_ANY); MODULE_VERSION(pflog, PFLOG_MODVER); MODULE_DEPEND(pflog, pf, PF_MODVER, PF_MODVER, PF_MODVER); |
