git: 1981d52a6e29 - stable/14 - pf: fix sctp deadlock

The branch stable/14 has been updated by kp:

URL: https://cgit.FreeBSD.org/src/commit/?id=1981d52a6e295f4b01a2cb95007806605d5e86ee

commit 1981d52a6e295f4b01a2cb95007806605d5e86ee
Author:     Kristof Provost <kp@FreeBSD.org>
AuthorDate: 2024-07-09 18:49:49 +0000
Commit:     Kristof Provost <kp@FreeBSD.org>
CommitDate: 2024-07-17 15:23:48 +0000

    pf: fix sctp deadlock
    
    It is possible for pf_test_state_sctp() to find a state and still return
    PF_DROP (or not PF_PASS, to be exact). In that case we would run pf_test_rule()
    unconditionally, but this would overwrite the (locked!) state pointer
    pf_test_state_sctp() gave us. As a result we will later deadlock, trying the
    lock the already locked state.
    
    Do what we do for UDP and TCP, and explicitly check s for NULL before we run
    pf_test_rule().
    
    MFC after:      1 week
    Sponsored by:   Orange Business Services
    
    (cherry picked from commit a9639adaedb4d67340c4ae386fe8fcd18e4a8a21)
---
 sys/netpfil/pf/pf.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c
index 6671839fc5ab..4eed6dd31860 100644
--- a/sys/netpfil/pf/pf.c
+++ b/sys/netpfil/pf/pf.c
@@ -8164,7 +8164,7 @@ pf_test(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0,
 				V_pfsync_update_state_ptr(s);
 			r = s->rule.ptr;
 			a = s->anchor.ptr;
-		} else {
+		} else if (s == NULL) {
 			action = pf_test_rule(&r, &s, kif, m, off,
 			    &pd, &a, &ruleset, inp);
 		}
@@ -8769,7 +8769,7 @@ pf_test6(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0, struct inpcb
 				V_pfsync_update_state_ptr(s);
 			r = s->rule.ptr;
 			a = s->anchor.ptr;
-		} else {
+		} else if (s == NULL) {
 			action = pf_test_rule(&r, &s, kif, m, off,
 			    &pd, &a, &ruleset, inp);
 		}