git: 489ded6d5231 - main - netlink_snl: make snl_free() safe to call twice

From: Kristof Provost <kp_at_FreeBSD.org>
Date: Fri, 30 Oct 2026 14:08:05 UTC
The branch main has been updated by kp:

URL: https://cgit.FreeBSD.org/src/commit/?id=489ded6d5231f44e02988e8c47969a9e6a1e07b7

commit 489ded6d5231f44e02988e8c47969a9e6a1e07b7
Author:     Avinash Duduskar <avinash.duduskar@gmail.com>
AuthorDate: 2026-10-28 10:22:14 +0000
Commit:     Kristof Provost <kp@FreeBSD.org>
CommitDate: 2026-10-30 14:06:08 +0000

    netlink_snl: make snl_free() safe to call twice
    
    snl_init() calls snl_free() on its own failure paths but leaves the
    state marked initialised and the buffer pointers set, so a caller that
    also frees the state on failure, as libpfctl's pfctl_open() does, closes
    the descriptor twice and, on the lb_init() failure path, frees the
    buffer twice. Reset what snl_free() releases so a second call is a
    no-op.
    
    Signed-off-by:  Avinash Duduskar <avinash.duduskar@gmail.com>
    Reviewed by:    kp
    Pull Request:   https://github.com/freebsd/freebsd-src/pull/2508
---
 sys/netlink/netlink_snl.h | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/sys/netlink/netlink_snl.h b/sys/netlink/netlink_snl.h
index 7800e2c50f49..03c5a573da21 100644
--- a/sys/netlink/netlink_snl.h
+++ b/sys/netlink/netlink_snl.h
@@ -252,13 +252,19 @@ snl_clear_lb(struct snl_state *ss)
 static void
 snl_free(struct snl_state *ss)
 {
-	if (ss->init_done)
+	if (ss->init_done) {
 		close(ss->fd);
-	if (ss->buf != NULL)
+		ss->fd = -1;
+		ss->init_done = false;
+	}
+	if (ss->buf != NULL) {
 		free(ss->buf);
+		ss->buf = NULL;
+	}
 	if (ss->lb != NULL) {
 		snl_clear_lb(ss);
 		lb_free(ss->lb);
+		ss->lb = NULL;
 	}
 }