git: 8b5f4e692b1d - main - pf: don't hold a lock during copyout()

[Kristof Provost]

The branch main has been updated by kp:

URL: https://cgit.FreeBSD.org/src/commit/?id=8b5f4e692b1d1585ecfc6690552650114e3e704e

commit 8b5f4e692b1d1585ecfc6690552650114e3e704e
Author:     Kristof Provost <kp at FreeBSD.org>
AuthorDate: 2021-06-14 12:04:02 +0000
Commit:     Kristof Provost <kp at FreeBSD.org>
CommitDate: 2021-06-14 12:17:31 +0000

    pf: don't hold a lock during copyout()
    
    copyout() can trigger page faults, so it may potentially sleep.
    
    Reported by:    avg
    MFC after:      3 days
    Sponsored by:   Rubicon Communications, LLC ("Netgate")
---
 sys/netpfil/pf/pf_ioctl.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sys/netpfil/pf/pf_ioctl.c b/sys/netpfil/pf/pf_ioctl.c
index a5903dc1b4ff..7a8d12ee4c3f 100644
--- a/sys/netpfil/pf/pf_ioctl.c
+++ b/sys/netpfil/pf/pf_ioctl.c
@@ -2520,8 +2520,6 @@ DIOCADDRULENV_error:
 			ERROUT(ENOSPC);
 		}
 
-		error = copyout(nvlpacked, nv->data, nv->len);
-
 		if (clear_counter) {
 			counter_u64_zero(rule->evaluations);
 			for (int i = 0; i < 2; i++) {
@@ -2532,6 +2530,8 @@ DIOCADDRULENV_error:
 		}
 		PF_RULES_WUNLOCK();
 
+		error = copyout(nvlpacked, nv->data, nv->len);
+
 #undef ERROUT
 DIOCGETRULENV_error:
 		free(nvlpacked, M_NVLIST);