pfsync: remove invalid panic

When we undefer a packet (when the peer acks the state) it's possible
that we don't find a corresponding pfsync_deferral. We panic here, but
that's actually something that can happen in normal operation:
 - if we have too many deferred packets already (in pfsync_defer())
 - if the deferral timed out (in pfsync_defer_tmo())

Remove this panic and document the scenarios where it might occur.

MFC after:	2 weeks
Sponsored by:	Orange Business Services

This commit is contained in:

Kristof Provost

2026-06-06 15:44:17 +02:00

parent 5f84c6db7a

commit 035e87247f

1 changed files with 5 additions and 1 deletions

									
										sys/netpfil/pf/if_pfsync.c
									
		+5
		-1
	
												View File
												
				@@ -2356,7 +2356,11 @@ pfsync_undefer_state_locked(struct pf_kstate *st, int drop)

						}

					}

					panic("%s: unable to find deferred state", __func__);

					/*

					 * If we don't find this state in b_deferrals that might be because we

					 * overflowed the list (see pfsync_defer()'s >= 128 check') or because

					 * the deferral timed out already (see pfsync_defer_tomo()).

					 */

				}

				static void