git: a4dc618ab4d8 - stable/15 - netipsec: Fix V_spd_size updates

The branch stable/15 has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=a4dc618ab4d866b8686e1c2da2c7d54bd7ea432d

commit a4dc618ab4d866b8686e1c2da2c7d54bd7ea432d
Author:     Mark Johnston <markj@FreeBSD.org>
AuthorDate: 2026-10-08 17:02:51 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2026-10-22 15:45:57 +0000

    netipsec: Fix V_spd_size updates
    
    key_unregister_ifnet() was erroneously decrementing the size of the
    global security policy database, V_sptree, but it doesn't modify that
    database.  V_sptree_ifnet is for policies attached to if_ipsec
    interfaces.  Note also that key_register_ifnet() was not incrementing
    the counter.
    
    Move the definition of V_spd_size up to the rest of the SPD definitions.
    Its inclusion among the SPD cache definitions was confusing to me.
    
    Reviewed by:    ae
    Reported by:    Stephan de Wit and Cedrik Pischem from OPNsense
    Sponsored by:   OPNsense
    Sponsored by:   Klara, Inc.
    MFC after:      2 weeks
    Differential Revision:  https://reviews.freebsd.org/D60418
    
    (cherry picked from commit 6b1d5fec57f9604a447864ec5e66940126b38df4)
---
 sys/netipsec/key.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/sys/netipsec/key.c b/sys/netipsec/key.c
index de1481ba4725..a0a206b6480e 100644
--- a/sys/netipsec/key.c
+++ b/sys/netipsec/key.c
@@ -183,6 +183,10 @@ static struct rmlock sptree_lock;
 #define	SPTREE_WLOCK_ASSERT()   rm_assert(&sptree_lock, RA_WLOCKED)
 #define	SPTREE_UNLOCK_ASSERT()  rm_assert(&sptree_lock, RA_UNLOCKED)
 
+/* Size of the SPD */
+VNET_DEFINE_STATIC(unsigned long, spd_size) = 0;
+#define	V_spd_size		VNET(spd_size)
+
 /* Hash table for lookup SP using unique id */
 VNET_DEFINE_STATIC(struct secpolicy_list *, sphashtbl);
 VNET_DEFINE_STATIC(u_long, sphash_mask);
@@ -209,8 +213,6 @@ VNET_DEFINE_STATIC(u_int, key_spdcache_maxentries) = 0;
 #define	V_key_spdcache_maxentries	VNET(key_spdcache_maxentries)
 VNET_DEFINE_STATIC(u_int, key_spdcache_threshold) = 32;
 #define	V_key_spdcache_threshold	VNET(key_spdcache_threshold)
-VNET_DEFINE_STATIC(unsigned long, spd_size) = 0;
-#define	V_spd_size		VNET(spd_size)
 
 #define SPDCACHE_ENABLED()	(V_key_spdcache_maxentries != 0)
 #define SPDCACHE_ACTIVE() \
@@ -1410,7 +1412,6 @@ key_unregister_ifnet(struct secpolicy **spp, u_int count)
 		ipsec_accel_spddel(spp[i]);
 		TAILQ_REMOVE(&V_sptree_ifnet[spp[i]->spidx.dir],
 		    spp[i], chain);
-		V_spd_size--;
 		LIST_REMOVE(spp[i], idhash);
 	}
 	SPTREE_WUNLOCK();