git: b2d547abb76f - stable/14 - pfsync: fix incorrect unlock during destroy

The branch stable/14 has been updated by kp:

URL: https://cgit.FreeBSD.org/src/commit/?id=b2d547abb76fb4e88c0fb58b50b8dfaf5447d737

commit b2d547abb76fb4e88c0fb58b50b8dfaf5447d737
Author:     Kristof Provost <kp@FreeBSD.org>
AuthorDate: 2025-12-01 21:30:56 +0000
Commit:     Kristof Provost <kp@FreeBSD.org>
CommitDate: 2025-12-09 10:29:27 +0000

    pfsync: fix incorrect unlock during destroy
    
    During pfsync_clone_destroy() we clean up pending packets. This
    may involve calling pfsync_undefer() or callout_drain(). We may not
    hold the bucket lock during callout_drain(), but must hold it during
    pfsync_undefer().
    
    We incorrectly always released the lock, leading to assertion failures
    during cleanup if there were pending deferred packets.
    
    MFC after:      1 week
    Sponsored by:   Orange Business Services
    
    (cherry picked from commit 639e65144aa71cb03b5431861803f528308760dc)
---
 sys/netpfil/pf/if_pfsync.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sys/netpfil/pf/if_pfsync.c b/sys/netpfil/pf/if_pfsync.c
index 2a5cb0612d36..cf46a8da94df 100644
--- a/sys/netpfil/pf/if_pfsync.c
+++ b/sys/netpfil/pf/if_pfsync.c
@@ -457,13 +457,13 @@ pfsync_clone_destroy(struct ifnet *ifp)
 			    TAILQ_FIRST(&b->b_deferrals);
 
 			ret = callout_stop(&pd->pd_tmo);
-			PFSYNC_BUCKET_UNLOCK(b);
 			if (ret > 0) {
 				pfsync_undefer(pd, 1);
 			} else {
+				PFSYNC_BUCKET_UNLOCK(b);
 				callout_drain(&pd->pd_tmo);
+				PFSYNC_BUCKET_LOCK(b);
 			}
-			PFSYNC_BUCKET_LOCK(b);
 		}
 		MPASS(b->b_deferred == 0);
 		MPASS(TAILQ_EMPTY(&b->b_deferrals));