From 8dc59178a893a4c449f5de298029c7d45311ec56 Mon Sep 17 00:00:00 2001
From: Gleb Smirnoff <glebius@FreeBSD.org>
Date: Fri, 21 Oct 2011 22:28:15 +0000
Subject: [PATCH] Fix a race: we should update sc_len before dropping the pf
 lock, otherwise a number of packets can be queued on sc, while we are in
 ip_output(), and then we wipe the accumulated sc_len. On next
 pfsync_sendout() that would lead to writing beyond our mbuf cluster.

---
 sys/contrib/pf/net/if_pfsync.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/sys/contrib/pf/net/if_pfsync.c b/sys/contrib/pf/net/if_pfsync.c
index 8ca7924846cb..4aaca76db972 100644
--- a/sys/contrib/pf/net/if_pfsync.c
+++ b/sys/contrib/pf/net/if_pfsync.c
@@ -2354,6 +2354,7 @@ pfsync_sendout(void)
 	sc->sc_if.if_obytes += m->m_pkthdr.len;
 #endif
 
+	sc->sc_len = PFSYNC_MINPKT;
 #ifdef __FreeBSD__
 	PF_UNLOCK();
 #endif
@@ -2375,9 +2376,6 @@ pfsync_sendout(void)
 #ifdef __FreeBSD__
 	}
 #endif
-
-	/* start again */
-	sc->sc_len = PFSYNC_MINPKT;
 }
 
 void