git: 011c5e68c95c - stable/14 - ipsec: Fix a lock leak in ipsec_chkreplay()

The branch stable/14 has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=011c5e68c95c8ec74b272dd2f2680fb6c6aa7dde

commit 011c5e68c95c8ec74b272dd2f2680fb6c6aa7dde
Author:     Mark Johnston <markj@FreeBSD.org>
AuthorDate: 2026-07-29 13:19:08 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2026-08-05 15:15:14 +0000

    ipsec: Fix a lock leak in ipsec_chkreplay()
    
    Reported by:    Chris Jarrett-Davies of the OpenAI Codex Security Team
    Reviewed by:    pouria, kp
    Fixes:          0361f165f219 ("ipsec: replace SECASVAR  mtx by rmlock")
    MFC after:      1 week
    Sponsored by:   The FreeBSD Foundation
    Differential Revision:  https://reviews.freebsd.org/D58521
    
    (cherry picked from commit b6823a973737f06ea6cf0ea5a3083383af2ba5a4)
---
 sys/netipsec/ipsec.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/sys/netipsec/ipsec.c b/sys/netipsec/ipsec.c
index 0ca33424bca8..e7a816f98d45 100644
--- a/sys/netipsec/ipsec.c
+++ b/sys/netipsec/ipsec.c
@@ -1330,8 +1330,10 @@ ipsec_chkreplay(uint32_t seq, uint32_t *seqhigh, struct secasvar *sav)
 	 * subspace.
 	 */
 	if (tl < window - 1 && seq >= bl) {
-		if (th == 0)
+		if (th == 0) {
+			SECREPLAY_UNLOCK(replay);
 			return (0);
+		}
 		*seqhigh = th - 1;
 		seqh = th - 1;
 		if (check_window(replay, seq)) {