git: c9547537ae4b - stable/15 - pf: do not leak a source hash row lock in the netlink dump

The branch stable/15 has been updated by rcm:

URL: https://cgit.FreeBSD.org/src/commit/?id=c9547537ae4bd03a804f11efd61ee0c1ef127e4e

commit c9547537ae4bd03a804f11efd61ee0c1ef127e4e
Author:     R. Christian McDonald <rcm@FreeBSD.org>
AuthorDate: 2026-10-02 17:10:56 +0000
Commit:     R. Christian McDonald <rcm@FreeBSD.org>
CommitDate: 2026-10-28 20:34:06 +0000

    pf: do not leak a source hash row lock in the netlink dump
    
    pf_handle_get_srcnodes() returns with the lock of a source hash row
    held when it cannot start the message for a source node.  Unlock the
    row there, as the other error exit of the loop does.
    
    Reviewed by:            kp
    Approved by:            kp (mentor)
    Fixes:                  9c125336727b ("pf: convert DIOCGETSRCNODES to netlink")
    MFC after:              1 week
    Sponsored by:           Rubicon Communications, LLC ("Netgate")
    Differential Revision:  https://reviews.freebsd.org/D60251
    
    (cherry picked from commit 782c6ea08603a4839c2c099842df92b6159b799f)
---
 sys/netpfil/pf/pf_nl.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sys/netpfil/pf/pf_nl.c b/sys/netpfil/pf/pf_nl.c
index d0c10a165969..4c33fbd7bc37 100644
--- a/sys/netpfil/pf/pf_nl.c
+++ b/sys/netpfil/pf/pf_nl.c
@@ -1763,6 +1763,7 @@ pf_handle_get_srcnodes(struct nlmsghdr *hdr, struct nl_pstate *npt)
 
 		LIST_FOREACH(n, &sh->nodes, entry) {
 			if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) {
+				PF_HASHROW_UNLOCK(sh);
 				nlmsg_abort(nw);
 				return (ENOMEM);
 			}