From c686a9d6d01c0679ff6f3dad3bb83dc2a20cbcff Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Claus=20Lensb=C3=B8l?= <claus@tailscale.com>
Date: Wed, 22 Oct 2025 10:59:28 -0400
Subject: [PATCH] net/portmapper: add UPnP-IGD release timeout
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Smallest possible change that could help mitigate a deadlock if a release
is haning.

Updates tailscale/corp#33619

Signed-off-by: Claus Lensbøl <claus@tailscale.com>
---
 net/portmapper/portmapper.go | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/portmapper/portmapper.go b/net/portmapper/portmapper.go
index 9368d1c4e..3cdfb76ed 100644
--- a/net/portmapper/portmapper.go
+++ b/net/portmapper/portmapper.go
@@ -395,7 +395,9 @@ func (c *Client) listenPacket(ctx context.Context, network, addr string) (nettyp
 func (c *Client) invalidateMappingsLocked(releaseOld bool) {
 	if c.mapping != nil {
 		if releaseOld {
-			c.mapping.Release(context.Background())
+			ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+			defer cancel()
+			c.mapping.Release(ctx)
 		}
 		c.mapping = nil
 	}