Craig Rodrigues d04dc94cac In sys/netpfil/ipfw/ip_fw_nat.c:vnet_ipfw_nat_uninit() we call "IPFW_WLOCK(chain);". ... This lock gets deleted in sys/netpfil/ipfw/ip_fw2.c:vnet_ipfw_uninit(). Therefore, vnet_ipfw_nat_uninit() *must* be called before vnet_ipfw_uninit(), but this doesn't always happen, because the VNET_SYSINIT order is the same for both functions. In sys/net/netpfil/ipfw/ip_fw2.c and sys/net/netpfil/ipfw/ip_fw_nat.c, IPFW_SI_SUB_FIREWALL == IPFW_NAT_SI_SUB_FIREWALL == SI_SUB_PROTO_IFATTACHDOMAIN and IPFW_MODULE_ORDER == IPFW_NAT_MODULE_ORDER Consequently, if VIMAGE is enabled, and jails are created and destroyed, the system sometimes crashes, because we are trying to use a deleted lock. To reproduce the problem: (1) Take a GENERIC kernel config, and add options for: VIMAGE, WITNESS, INVARIANTS. (2) Run this command in a loop: jail -l -u root -c path=/ name=foo persist vnet && jexec foo ifconfig lo0 127.0.0.1/8 && jail -r foo (see http://lists.freebsd.org/pipermail/freebsd-current/2010-November/021280.html ) Fix the problem by increasing the value of IPFW_NAT_SI_SUB_FIREWALL, so that vnet_ipfw_nat_uninit() runs after vnet_ipfw_uninit().		2013-11-25 20:20:34 +00:00
..
test
dn_heap.c
dn_heap.h	o Create directory sys/netpfil, where all packet filters should	2012-09-14 11:51:49 +00:00
dn_sched_fifo.c
dn_sched_prio.c
dn_sched_qfq.c
dn_sched_rr.c
dn_sched_wf2q.c
dn_sched.h	add a counter on the struct mq (a queue of mbufs),	2013-11-22 05:02:37 +00:00
dummynet.txt
ip_dn_glue.c	Mechanically substitute flags from historic mbuf allocator with	2012-12-05 08:04:20 +00:00
ip_dn_io.c	add a counter on the struct mq (a queue of mbufs),	2013-11-22 05:02:37 +00:00
ip_dn_private.h	add a counter on the struct mq (a queue of mbufs),	2013-11-22 05:02:37 +00:00
ip_dummynet.c	Provide includes that are needed in these files, and before were read	2013-10-26 18:18:50 +00:00
ip_fw2.c	disable some ipfw match options when compiling in userspace	2013-11-22 05:01:38 +00:00
ip_fw_dynamic.c	more support for userspace compiling of this code:	2013-11-22 04:59:17 +00:00
ip_fw_log.c	make this code compile in userspace on OSX	2013-11-22 05:00:18 +00:00
ip_fw_nat.c	In sys/netpfil/ipfw/ip_fw_nat.c:vnet_ipfw_nat_uninit() we call "IPFW_WLOCK(chain);".	2013-11-25 20:20:34 +00:00
ip_fw_pfil.c	make ipfw_check_packet() and ipfw_check_frame() public,	2013-11-22 04:57:50 +00:00
ip_fw_private.h	Make ipfw nat init/unint work correctly for VIMAGE:	2013-08-24 11:59:51 +00:00
ip_fw_sockopt.c	Fix ipfw rule validation partially broken by r248552.	2013-04-01 11:28:52 +00:00
ip_fw_table.c