On Mon, Jan 01, 2024 at 12:20:09AM +0100, Alexander Bluhm wrote:
> @@ -1801,12 +1813,22 @@ pf_remove_state(struct pf_state *st)
>  }
>  
>  void
> -pf_remove_divert_state(struct pf_state_key *sk)
> +pf_remove_divert_state(struct inpcb *inp)
>  {
> +	struct pf_state_key	*sk;
>  	struct pf_state_item	*si;
>  
>  	PF_ASSERT_UNLOCKED();
>  
> +	if (READ_ONCE(inp->inp_pf_sk) == NULL)
> +		return;
> +
> +	mtx_enter(&pf_inp_mtx);
> +	sk = pf_state_key_ref(inp->inp_pf_sk);
> +	mtx_leave(&pf_inp_mtx);
> +        if (sk == NULL)
> +                return;

whitespace before the "if"?

> +
>  	PF_LOCK();
>  	PF_STATE_ENTER_WRITE();
>  	TAILQ_FOREACH(si, &sk->sk_states, si_entry) {
> @@ -1837,6 +1859,8 @@ pf_remove_divert_state(struct pf_state_k
>  	}
>  	PF_STATE_EXIT_WRITE();
>  	PF_UNLOCK();
> +
> +	pf_state_key_unref(sk);
>  }
>  
>  void