git: 371bd29d4b22 - main - pf: fix potential state key leak

The branch main has been updated by kp:

URL: https://cgit.FreeBSD.org/src/commit/?id=371bd29d4b22257a7e92e1e711cca3d94cfbd00d

commit 371bd29d4b22257a7e92e1e711cca3d94cfbd00d
Author:     Kristof Provost <kp@FreeBSD.org>
AuthorDate: 2024-11-09 09:53:37 +0000
Commit:     Kristof Provost <kp@FreeBSD.org>
CommitDate: 2024-11-13 09:34:08 +0000

    pf: fix potential state key leak
    
    If we fail to attach the new state keys in pf_state_key_attach() we are
    expected to free both keys. Do so.
    Note that in some scenarios both key are the same, so check for that
    before freeing.
    
    MFC after:      2 weeks
    Sponsored by:   Rubicon Communications, LLC ("Netgate")
    Differential Revision:  https://reviews.freebsd.org/D47495
---
 sys/netpfil/pf/pf.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c
index 90ec2b1ed033..691cb697a659 100644
--- a/sys/netpfil/pf/pf.c
+++ b/sys/netpfil/pf/pf.c
@@ -1433,7 +1433,9 @@ keyattach:
 					s->timeout = PFTM_UNLINKED;
 					PF_HASHROW_UNLOCK(ih);
 					KEYS_UNLOCK();
-					uma_zfree(V_pf_state_key_z, sk);
+					uma_zfree(V_pf_state_key_z, skw);
+					if (skw != sks)
+						uma_zfree(V_pf_state_key_z, sks);
 					if (idx == PF_SK_STACK)
 						pf_detach_state(s);
 					return (EEXIST); /* collision! */