git: b6823a973737 - main - ipsec: Fix a lock leak in ipsec_chkreplay()

The branch main has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=b6823a973737f06ea6cf0ea5a3083383af2ba5a4

commit b6823a973737f06ea6cf0ea5a3083383af2ba5a4
Author:     Mark Johnston <markj@FreeBSD.org>
AuthorDate: 2026-07-29 13:19:08 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2026-07-29 13:19:08 +0000

    ipsec: Fix a lock leak in ipsec_chkreplay()
    
    Reported by:    Chris Jarrett-Davies of the OpenAI Codex Security Team
    Reviewed by:    pouria, kp
    Fixes:          0361f165f219 ("ipsec: replace SECASVAR  mtx by rmlock")
    MFC after:      1 week
    Sponsored by:   The FreeBSD Foundation
    Differential Revision:  https://reviews.freebsd.org/D58521
---
 sys/netipsec/ipsec.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/sys/netipsec/ipsec.c b/sys/netipsec/ipsec.c
index 92d0201b398a..12d1b7945e64 100644
--- a/sys/netipsec/ipsec.c
+++ b/sys/netipsec/ipsec.c
@@ -1353,8 +1353,10 @@ ipsec_chkreplay(uint32_t seq, uint32_t *seqhigh, struct secasvar *sav)
 	 * subspace.
 	 */
 	if (tl < window - 1 && seq >= bl) {
-		if (th == 0)
+		if (th == 0) {
+			SECREPLAY_UNLOCK(replay);
 			return (0);
+		}
 		*seqhigh = th - 1;
 		seqh = th - 1;
 		if (check_window(replay, seq)) {