svn commit: r340571 - stable/11/sys/netpfil/pf

[Kristof Provost]

Author: kp
Date: Sun Nov 18 12:09:27 2018
New Revision: 340571
URL: https://svnweb.freebsd.org/changeset/base/340571

Log:
  MFC r340067:
  
  pfsync: Ensure uninit is done before pf
  
  pfsync touches pf memory (for pf_state and the pfsync callback
  pointers), not the other way around. We need to ensure that pfsync is
  torn down before pf.
  
  Sponsored by:	Orange Business Services

Modified:
  stable/11/sys/netpfil/pf/if_pfsync.c
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/sys/netpfil/pf/if_pfsync.c
==============================================================================
--- stable/11/sys/netpfil/pf/if_pfsync.c	Sun Nov 18 12:09:26 2018	(r340570)
+++ stable/11/sys/netpfil/pf/if_pfsync.c	Sun Nov 18 12:09:27 2018	(r340571)
@@ -2360,11 +2360,8 @@ vnet_pfsync_uninit(const void *unused __unused)
 	if_clone_detach(V_pfsync_cloner);
 	swi_remove(V_pfsync_swi_cookie);
 }
-/*
- * Detach after pf is gone; otherwise we might touch pfsync memory
- * from within pf after freeing pfsync.
- */
-VNET_SYSUNINIT(vnet_pfsync_uninit, SI_SUB_INIT_IF, SI_ORDER_SECOND,
+
+VNET_SYSUNINIT(vnet_pfsync_uninit, SI_SUB_PROTO_FIREWALL, SI_ORDER_FOURTH,
     vnet_pfsync_uninit, NULL);
 
 static int