git: 93c80b79ad65 - stable/14 - pf: fix potential state key leak

The branch stable/14 has been updated by kp:

URL: https://cgit.FreeBSD.org/src/commit/?id=93c80b79ad6564a17553fc1df41d57dc9da4cdec

commit 93c80b79ad6564a17553fc1df41d57dc9da4cdec
Author:     Kristof Provost <kp@FreeBSD.org>
AuthorDate: 2024-11-09 09:53:37 +0000
Commit:     Kristof Provost <kp@FreeBSD.org>
CommitDate: 2024-11-27 13:19:53 +0000

    pf: fix potential state key leak
    
    If we fail to attach the new state keys in pf_state_key_attach() we are
    expected to free both keys. Do so.
    Note that in some scenarios both key are the same, so check for that
    before freeing.
    
    MFC after:      2 weeks
    Sponsored by:   Rubicon Communications, LLC ("Netgate")
    Differential Revision:  https://reviews.freebsd.org/D47495
    
    (cherry picked from commit 371bd29d4b22257a7e92e1e711cca3d94cfbd00d)
---
 sys/netpfil/pf/pf.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c
index 4fd884852d90..80f3fdae1861 100644
--- a/sys/netpfil/pf/pf.c
+++ b/sys/netpfil/pf/pf.c
@@ -1345,7 +1345,9 @@ keyattach:
 					s->timeout = PFTM_UNLINKED;
 					PF_HASHROW_UNLOCK(ih);
 					KEYS_UNLOCK();
-					uma_zfree(V_pf_state_key_z, sk);
+					uma_zfree(V_pf_state_key_z, skw);
+					if (skw != sks)
+						uma_zfree(V_pf_state_key_z, sks);
 					if (idx == PF_SK_STACK)
 						pf_detach_state(s);
 					return (EEXIST); /* collision! */