Skip site navigation (1)Skip section navigation (2) 
Date:      Wed, 10 Jun 2026 22:03:50 +0000
From:      Siva Mahadevan <siva@FreeBSD.org>
To:        src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org
Subject:   git: 432ac5c07c6b - main - pf: free match rules after exiting critical section
Message-ID:  <6a29df46.33006.32d4c5dd@gitrepo.freebsd.org>
index | next in thread | raw e-mail 

The branch main has been updated by siva:

URL: https://cgit.FreeBSD.org/src/commit/?id=432ac5c07c6b1fb960f2e7d8e8cfb1306ce351ff

commit 432ac5c07c6b1fb960f2e7d8e8cfb1306ce351ff
Author:     Siva Mahadevan <siva@FreeBSD.org>
AuthorDate: 2026-06-07 01:26:55 +0000
Commit:     Siva Mahadevan <siva@FreeBSD.org>
CommitDate: 2026-06-10 21:50:27 +0000

    pf: free match rules after exiting critical section
    
    This fixes a panic reported on armv7:
    
    sys/netpfil/pf/counters:match_block  ->  panic: free: called with spinlock or critical section held
    [...]
    vpanic() at vpanic
             pc = 0xc0321b5c  lr = 0xc02f7b5c (free+0x140)
             sp = 0xc8c858bc  fp = 0xc8c858e0
             r4 = 0xe2fad648  r5 = 0xe402ce78
             r6 = 0xc8c859e8  r7 = 0x0000001c
             r8 = 0xc8c858b4  r9 = 0xc0321b5c
            r10 = 0xc8c858bc
    free() at free+0x140
             pc = 0xc02f7b5c  lr = 0xe2f4f920 ($a+0x5f8)
             sp = 0xc8c858e8  fp = 0xc8c85930
             r4 = 0xe402ce68  r5 = 0xc8c8599c
             r6 = 0xffffffff r10 = 0x0000001c
    [...]
    KDB: enter: panic
    
    Consequently, this fixes armv7 CI:
    https://ci.freebsd.org/job/FreeBSD-main-armv7-test/2287/consoleText
    
    Fixes:  6353f5d9a5c6f194bb014b8785a57f5314e8c652
    Reviewed by:    kp
    MFC after:      3 days
---
 sys/netpfil/pf/pf.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c
index 98b5657f7285..c7d5e923d50b 100644
--- a/sys/netpfil/pf/pf.c
+++ b/sys/netpfil/pf/pf.c
@@ -11544,10 +11544,6 @@ pf_counters_inc(int action, struct pf_pdesc *pd, struct pf_kstate *s,
 		}
 	}
 
-	if (s == NULL) {
-		pf_free_match_rules(mr);
-	}
-
 	if (a != NULL) {
 		pf_rule_counters_inc(pd, a, dir_out, op_r_pass, af,
 		    src_host, dst_host);
@@ -11559,6 +11555,10 @@ pf_counters_inc(int action, struct pf_pdesc *pd, struct pf_kstate *s,
 	}
 
 	pf_counter_u64_critical_exit();
+
+	if (s == NULL) {
+		pf_free_match_rules(mr);
+	}
 }
 
 static void
home | help

Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?6a29df46.33006.32d4c5dd>