git: c68c7059a586 - stable/15 - ipsec: Fix a lock leak in ipsec_chkreplay()

The branch stable/15 has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=c68c7059a586f05e725255234fac37ba1c89668d

commit c68c7059a586f05e725255234fac37ba1c89668d
Author:     Mark Johnston <[email protected]>
AuthorDate: 2026-07-29 13:19:08 +0000
Commit:     Mark Johnston <[email protected]>
CommitDate: 2026-08-06 13:24:43 +0000

    ipsec: Fix a lock leak in ipsec_chkreplay()
    
    Reported by:    Chris Jarrett-Davies of the OpenAI Codex Security Team
    Reviewed by:    pouria, kp
    Fixes:          0361f165f219 ("ipsec: replace SECASVAR  mtx by rmlock")
    MFC after:      1 week
    Sponsored by:   The FreeBSD Foundation
    Differential Revision:  https://reviews.freebsd.org/D58521
    
    (cherry picked from commit b6823a973737f06ea6cf0ea5a3083383af2ba5a4)
---
 sys/netipsec/ipsec.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/sys/netipsec/ipsec.c b/sys/netipsec/ipsec.c
index 92d0201b398a..12d1b7945e64 100644
--- a/sys/netipsec/ipsec.c
+++ b/sys/netipsec/ipsec.c
@@ -1353,8 +1353,10 @@ ipsec_chkreplay(uint32_t seq, uint32_t *seqhigh, struct secasvar *sav)
 	 * subspace.
 	 */
 	if (tl < window - 1 && seq >= bl) {
-		if (th == 0)
+		if (th == 0) {
+			SECREPLAY_UNLOCK(replay);
 			return (0);
+		}
 		*seqhigh = th - 1;
 		seqh = th - 1;
 		if (check_window(replay, seq)) {