git: b4b2e420195a - stable/13 - pf: fix potential state key leak

The branch stable/13 has been updated by kp:

URL: https://cgit.FreeBSD.org/src/commit/?id=b4b2e420195affca5251ad40e268aeaff9fc5623

commit b4b2e420195affca5251ad40e268aeaff9fc5623
Author:     Kristof Provost <kp@FreeBSD.org>
AuthorDate: 2024-11-09 09:53:37 +0000
Commit:     Kristof Provost <kp@FreeBSD.org>
CommitDate: 2024-11-27 07:28:01 +0000

    pf: fix potential state key leak
    
    If we fail to attach the new state keys in pf_state_key_attach() we are
    expected to free both keys. Do so.
    Note that in some scenarios both key are the same, so check for that
    before freeing.
    
    MFC after:      2 weeks
    Sponsored by:   Rubicon Communications, LLC ("Netgate")
    Differential Revision:  https://reviews.freebsd.org/D47495
    
    (cherry picked from commit 371bd29d4b22257a7e92e1e711cca3d94cfbd00d)
---
 sys/netpfil/pf/pf.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c
index 810966f88a89..8dc7a153c3ce 100644
--- a/sys/netpfil/pf/pf.c
+++ b/sys/netpfil/pf/pf.c
@@ -1302,7 +1302,9 @@ keyattach:
 					s->timeout = PFTM_UNLINKED;
 					PF_HASHROW_UNLOCK(ih);
 					KEYS_UNLOCK();
-					uma_zfree(V_pf_state_key_z, sk);
+					uma_zfree(V_pf_state_key_z, skw);
+					if (skw != sks)
+						uma_zfree(V_pf_state_key_z, sks);
 					if (idx == PF_SK_STACK)
 						pf_detach_state(s);
 					return (EEXIST); /* collision! */