git: 9b2551051fce - stable/13 - pfsync: fix incorrect unlock during destroy

The branch stable/13 has been updated by kp:

URL: https://cgit.FreeBSD.org/src/commit/?id=9b2551051fce2b56bcc8f4d03596205225d5832b

commit 9b2551051fce2b56bcc8f4d03596205225d5832b
Author:     Kristof Provost <kp@FreeBSD.org>
AuthorDate: 2025-12-01 21:30:56 +0000
Commit:     Kristof Provost <kp@FreeBSD.org>
CommitDate: 2025-12-08 09:34:20 +0000

    pfsync: fix incorrect unlock during destroy
    
    During pfsync_clone_destroy() we clean up pending packets. This
    may involve calling pfsync_undefer() or callout_drain(). We may not
    hold the bucket lock during callout_drain(), but must hold it during
    pfsync_undefer().
    
    We incorrectly always released the lock, leading to assertion failures
    during cleanup if there were pending deferred packets.
    
    MFC after:      1 week
    Sponsored by:   Orange Business Services
    
    (cherry picked from commit 639e65144aa71cb03b5431861803f528308760dc)
---
 sys/netpfil/pf/if_pfsync.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sys/netpfil/pf/if_pfsync.c b/sys/netpfil/pf/if_pfsync.c
index c43cb59d8705..cc5b62d47df3 100644
--- a/sys/netpfil/pf/if_pfsync.c
+++ b/sys/netpfil/pf/if_pfsync.c
@@ -402,13 +402,13 @@ pfsync_clone_destroy(struct ifnet *ifp)
 			    TAILQ_FIRST(&b->b_deferrals);
 
 			ret = callout_stop(&pd->pd_tmo);
-			PFSYNC_BUCKET_UNLOCK(b);
 			if (ret > 0) {
 				pfsync_undefer(pd, 1);
 			} else {
+				PFSYNC_BUCKET_UNLOCK(b);
 				callout_drain(&pd->pd_tmo);
+				PFSYNC_BUCKET_LOCK(b);
 			}
-			PFSYNC_BUCKET_LOCK(b);
 		}
 		MPASS(b->b_deferred == 0);
 		MPASS(TAILQ_EMPTY(&b->b_deferrals));