git: 06f98c554fbe - main - pf: Store the rounded source node hash size

The branch main has been updated by rcm:

URL: https://cgit.FreeBSD.org/src/commit/?id=06f98c554fbe1fa9a678aacbcf1bc25bda0aef91

commit 06f98c554fbe1fa9a678aacbcf1bc25bda0aef91
Author:     R. Christian McDonald <rcm@FreeBSD.org>
AuthorDate: 2026-10-28 16:10:17 +0000
Commit:     R. Christian McDonald <rcm@FreeBSD.org>
CommitDate: 2026-10-28 16:10:17 +0000

    pf: Store the rounded source node hash size
    
    hashalloc(9) rounds the requested size down to a power of two and writes
    the result back, but pf_initialize() stored it into the mask, which the
    next line overwrites from the unrounded size.  With a
    net.pf.source_nodes_hashsize that is not a power of two the mask is
    larger than the table: pf_hashsrc() returns rows past its end, the row
    walkers in pf_purge_expired_src_nodes() and the ioctl handlers run past
    it, and pf_cleanup() frees it with the wrong size.  The key and UDP
    endpoint hashes already take the rounded size.
    
    Reviewed by:            glebius, kp
    Fixes:                  cd5ff4e841fb ("pf: use hashalloc(9) for key, id, src-node and udp-endpoint hashes")
    Sponsored by:           Rubicon Communications, LLC ("Netgate")
    Differential Revision:  https://reviews.freebsd.org/D60949
---
 sys/netpfil/pf/pf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c
index 94985f47677c..bbba67529d09 100644
--- a/sys/netpfil/pf/pf.c
+++ b/sys/netpfil/pf/pf.c
@@ -1583,7 +1583,7 @@ retry_waitok2:
 		ha.mflags = M_WAITOK;
 		goto retry_waitok2;
 	}
-	V_pf_srchashmask = ha.size;
+	V_pf_srchashsize = ha.size;
 	V_pf_srchashmask = V_pf_srchashsize - 1;
 
 	/* UDP endpoint mappings. */