git: 05ac1013984c - main - pf: fix error handling in pf_sourcelim_add()

The branch main has been updated by kp:

URL: https://cgit.FreeBSD.org/src/commit/?id=05ac1013984ced5b8b57430fe92a7074e34054ce

commit 05ac1013984ced5b8b57430fe92a7074e34054ce
Author:     Kristof Provost <kp@FreeBSD.org>
AuthorDate: 2026-04-16 13:49:26 +0000
Commit:     Kristof Provost <kp@FreeBSD.org>
CommitDate: 2026-04-17 11:55:06 +0000

    pf: fix error handling in pf_sourcelim_add()
    
    There are two issues in pf_sourcelim_add() error path:
      - stale pointers are left in pf_sourcelim_id_tree_inactive when
        duplicate source limiter instance is found in pf_sourcelim_nm_tree
    
      - overload table may leak when insertion of new source limiter instance
        fails.
    
    Both issues reported and patch submitted by:
        Renaud Allard <renaud () allard ! it>
    
    OK sashan@
    
    Obtained from:  OpenBSD, sashan <sashan@openbsd.org>, 32063577ec
    Sponsored by:   Rubicon Communications, LLC ("Netgate")
---
 sys/netpfil/pf/pf_ioctl.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/sys/netpfil/pf/pf_ioctl.c b/sys/netpfil/pf/pf_ioctl.c
index a2e12b3065d0..8b2ff108d9cb 100644
--- a/sys/netpfil/pf/pf_ioctl.c
+++ b/sys/netpfil/pf/pf_ioctl.c
@@ -2239,7 +2239,7 @@ pf_sourcelim_add(const struct pfioc_sourcelim *ioc)
 
 	if (RB_INSERT(pf_sourcelim_nm_tree, &V_pf_sourcelim_nm_tree_inactive,
 		pfsrlim) != NULL) {
-		RB_INSERT(pf_sourcelim_nm_tree, &V_pf_sourcelim_nm_tree_inactive,
+		RB_REMOVE(pf_sourcelim_nm_tree, &V_pf_sourcelim_nm_tree_inactive,
 		    pfsrlim);
 		error = EBUSY;
 		goto unlock;
@@ -2252,6 +2252,8 @@ pf_sourcelim_add(const struct pfioc_sourcelim *ioc)
 	return (0);
 
 unlock:
+	if (pfsrlim->pfsrlim_overload.table != NULL)
+		pfr_detach_table(pfsrlim->pfsrlim_overload.table);
 	PF_RULES_WUNLOCK();
 
 free: