git: d8b2c298a117 - main - pfsync: improve underflow check

The branch main has been updated by kp:

URL: https://cgit.FreeBSD.org/src/commit/?id=d8b2c298a117416a57cad176718b87eb504bfb49

commit d8b2c298a117416a57cad176718b87eb504bfb49
Author:     Kristof Provost <kp@FreeBSD.org>
AuthorDate: 2026-11-02 09:50:30 +0000
Commit:     Kristof Provost <kp@FreeBSD.org>
CommitDate: 2026-11-02 12:40:01 +0000

    pfsync: improve underflow check
    
    We checked the state's expiry time to make sure it was large enough to
    not underflow if we subtracted the already expired time from the remote
    end, but we failed to account for the state's expiry time being in
    miliseconds and the pfsync time delta being in seconds.
    
    Take that multiplication by 1000 into account.
    
    Fixes:  78b620b781b0 (pfsync: avoid underflow on different timeouts, 2026-10-21)
    Reported by:    markj's Post-Commit LLM Review Service
    Sponsored by:   Rubicon Communications, LLC ("Netgate")
---
 sys/netpfil/pf/if_pfsync.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/sys/netpfil/pf/if_pfsync.c b/sys/netpfil/pf/if_pfsync.c
index 97688294bebc..0f649ecee8ad 100644
--- a/sys/netpfil/pf/if_pfsync.c
+++ b/sys/netpfil/pf/if_pfsync.c
@@ -872,9 +872,9 @@ pfsync_state_import(union pfsync_state_union *sp, int flags, int msg_version)
 		 * Ensure we don't over/under flow if our local timeout or
 		 * uptime is lower than the remote timeout.
 		 */
-		if (timeout > expire && st->expire > (timeout - expire))
-			st->expire -= (timeout - expire)
-			    * 1000;
+		if (timeout > expire &&
+		    st->expire > ((timeout - expire) * 1000))
+			st->expire -= (timeout - expire) * 1000;
 	}
 
 	if (! (st->act.rtableid == -1 ||