git: 01eb1261443d - main - pf: fix double free in pf_state_key_attach()

The branch main has been updated by kp:

URL: https://cgit.FreeBSD.org/src/commit/?id=01eb1261443dddcb50a3a278f1278fffdfb0d36e

commit 01eb1261443dddcb50a3a278f1278fffdfb0d36e
Author:     Kristof Provost <kp@FreeBSD.org>
AuthorDate: 2024-12-11 22:27:21 +0000
Commit:     Kristof Provost <kp@FreeBSD.org>
CommitDate: 2024-12-17 20:33:11 +0000

    pf: fix double free in pf_state_key_attach()
    
    In 371bd29d4b we fixed a state key leak, but unintentionally introduced a double free.
    We pass through the relevant code twice, first for PF_SK_WIRE, then for
    PF_SK_STACK. If we fail to attach on the second pass we have a more complex
    cleanup job, handled by pf_detach_state(). We must only free the state keys
    manually on the first pass, on the second one pf_detach_state() takes care of
    everything.
    
    Tested by:      yds <yds@Necessitu.de>
    Fixes:          371bd29d4b22257a7e92e1e711cca3d94cfbd00d
    MFC after:      2 weeks
    Sponsored by:   Rubicon Communications, LLC ("Netgate")
---
 sys/netpfil/pf/pf.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c
index f2e19693b863..11d37747b3a0 100644
--- a/sys/netpfil/pf/pf.c
+++ b/sys/netpfil/pf/pf.c
@@ -1477,11 +1477,13 @@ keyattach:
 					s->timeout = PFTM_UNLINKED;
 					PF_HASHROW_UNLOCK(ih);
 					KEYS_UNLOCK();
-					uma_zfree(V_pf_state_key_z, skw);
-					if (skw != sks)
-						uma_zfree(V_pf_state_key_z, sks);
-					if (idx == PF_SK_STACK)
+					if (idx == PF_SK_WIRE) {
+						uma_zfree(V_pf_state_key_z, skw);
+						if (skw != sks)
+							uma_zfree(V_pf_state_key_z, sks);
+					} else {
 						pf_detach_state(s);
+					}
 					return (EEXIST); /* collision! */
 				}
 			}