git: 2e9ac12e9793 - main - pf: fix pf_krule_item memory leak during counters:match_fail

The branch main has been updated by kp:

URL: https://cgit.FreeBSD.org/src/commit/?id=2e9ac12e97939d536c02877a41807dee05717ea5

commit 2e9ac12e97939d536c02877a41807dee05717ea5
Author:     Kristof Provost <kp@FreeBSD.org>
AuthorDate: 2026-10-28 10:35:57 +0000
Commit:     Kristof Provost <kp@FreeBSD.org>
CommitDate: 2026-10-30 12:21:11 +0000

    pf: fix pf_krule_item memory leak during counters:match_fail
    
    If pf_counters_inc() did not increment the counters because the rule
    failed to apply it potentially failed to free match rules (which were
    not bound to a state already).
    
    Do so.
    
    While here explicitly hand match_rules over from the pf_test_ctx to the
    state so we never list them in two places.
    
    Sponsored by:   Rubicon Communications, LLC ("Netgate")
---
 sys/netpfil/pf/pf.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c
index db21fefd9595..2d4efbe1e3e8 100644
--- a/sys/netpfil/pf/pf.c
+++ b/sys/netpfil/pf/pf.c
@@ -6699,6 +6699,7 @@ pf_create_state(struct pf_krule *r, struct pf_test_ctx *ctx,
 	s->nat_rule = ctx->nr;
 	s->anchor = ctx->a;
 	s->match_rules = *ctx->match_rules;
+	SLIST_INIT(ctx->match_rules); /* The state owns these now. */
 	SLIST_INIT(&s->linkage);
 	memcpy(&s->act, &pd->act, sizeof(struct pf_rule_actions));
 
@@ -11519,7 +11520,7 @@ pf_counters_inc(int action, struct pf_pdesc *pd, struct pf_kstate *s,
 
 	/* If the rule has failed to apply, don't increase its counters */
 	if (!(op_pass || r->action == PF_DROP)) {
-		return;
+		goto out;
 	}
 
 	if (s != NULL) {
@@ -11617,6 +11618,7 @@ pf_counters_inc(int action, struct pf_pdesc *pd, struct pf_kstate *s,
 		    src_host, dst_host);
 	}
 
+out:
 	if (s == NULL) {
 		pf_free_match_rules(mr);
 	}