git: 68013761ce74 - stable/14 - libpfctl: handle pfctl_do_ioctl() failures better

The branch stable/14 has been updated by kp:

URL: https://cgit.FreeBSD.org/src/commit/?id=68013761ce7403bce5ab842885eceade23488796

commit 68013761ce7403bce5ab842885eceade23488796
Author:     Kristof Provost <kp@FreeBSD.org>
AuthorDate: 2023-11-17 09:19:38 +0000
Commit:     Kristof Provost <kp@FreeBSD.org>
CommitDate: 2023-11-24 09:19:13 +0000

    libpfctl: handle pfctl_do_ioctl() failures better
    
    Ensure that we free nvlists and other allocations if pfctl_do_ioctl()
    fails.
    
    MFC after:      1 week
    Sponsored by:   Rubicon Communications, LLC ("Netgate")
    
    (cherry picked from commit 498934c5ff51e6b0d3199db5d27ed11b1e8b9582)
---
 lib/libpfctl/libpfctl.c | 42 ++++++++++++++++++++++++------------------
 1 file changed, 24 insertions(+), 18 deletions(-)

diff --git a/lib/libpfctl/libpfctl.c b/lib/libpfctl/libpfctl.c
index 1ef96f52c19c..f43fb78d9a0f 100644
--- a/lib/libpfctl/libpfctl.c
+++ b/lib/libpfctl/libpfctl.c
@@ -221,6 +221,7 @@ pfctl_get_status(int dev)
 	nvl = nvlist_create(0);
 
 	if (pfctl_do_ioctl(dev, DIOCGETSTATUSNV, 4096, &nvl)) {
+		nvlist_destroy(nvl);
 		free(status);
 		return (NULL);
 	}
@@ -741,12 +742,13 @@ pfctl_get_eth_rulesets_info(int dev, struct pfctl_eth_rulesets_info *ri,
 	nvlist_add_string(nvl, "path", path);
 
 	if ((ret = pfctl_do_ioctl(dev, DIOCGETETHRULESETS, 256, &nvl)) != 0)
-		return (ret);
+		goto out;
 
 	ri->nr = nvlist_get_number(nvl, "nr");
 
+out:
 	nvlist_destroy(nvl);
-	return (0);
+	return (ret);
 }
 
 int
@@ -763,16 +765,16 @@ pfctl_get_eth_ruleset(int dev, const char *path, int nr,
 	nvlist_add_number(nvl, "nr", nr);
 
 	if ((ret = pfctl_do_ioctl(dev, DIOCGETETHRULESET, 1024, &nvl)) != 0)
-		return (ret);
+		goto out;
 
 	ri->nr = nvlist_get_number(nvl, "nr");
 	strlcpy(ri->path, nvlist_get_string(nvl, "path"), MAXPATHLEN);
 	strlcpy(ri->name, nvlist_get_string(nvl, "name"),
 	    PF_ANCHOR_NAME_SIZE);
 
+out:
 	nvlist_destroy(nvl);
-
-	return (0);
+	return (ret);
 }
 
 int
@@ -788,13 +790,14 @@ pfctl_get_eth_rules_info(int dev, struct pfctl_eth_rules_info *rules,
 	nvlist_add_string(nvl, "anchor", path);
 
 	if ((ret = pfctl_do_ioctl(dev, DIOCGETETHRULES, 1024, &nvl)) != 0)
-		return (ret);
+		goto out;
 
 	rules->nr = nvlist_get_number(nvl, "nr");
 	rules->ticket = nvlist_get_number(nvl, "ticket");
 
+out:
 	nvlist_destroy(nvl);
-	return (0);
+	return (ret);
 }
 
 int
@@ -813,7 +816,7 @@ pfctl_get_eth_rule(int dev, uint32_t nr, uint32_t ticket,
 	nvlist_add_bool(nvl, "clear", clear);
 
 	if ((ret = pfctl_do_ioctl(dev, DIOCGETETHRULE, 4096, &nvl)) != 0)
-		return (ret);
+		goto out;
 
 	pfctl_nveth_rule_to_eth_rule(nvl, rule);
 
@@ -821,8 +824,9 @@ pfctl_get_eth_rule(int dev, uint32_t nr, uint32_t ticket,
 		strlcpy(anchor_call, nvlist_get_string(nvl, "anchor_call"),
 		    MAXPATHLEN);
 
+out:
 	nvlist_destroy(nvl);
-	return (0);
+	return (ret);
 }
 
 int
@@ -1079,7 +1083,7 @@ int	pfctl_get_clear_rule(int dev, uint32_t nr, uint32_t ticket,
 		nvlist_add_bool(nvl, "clear_counter", true);
 
 	if ((ret = pfctl_do_ioctl(dev, DIOCGETRULENV, 8192, &nvl)) != 0)
-		return (ret);
+		goto out;
 
 	pf_nvrule_to_rule(nvlist_get_nvlist(nvl, "rule"), rule);
 
@@ -1087,9 +1091,9 @@ int	pfctl_get_clear_rule(int dev, uint32_t nr, uint32_t ticket,
 		strlcpy(anchor_call, nvlist_get_string(nvl, "anchor_call"),
 		    MAXPATHLEN);
 
+out:
 	nvlist_destroy(nvl);
-
-	return (0);
+	return (ret);
 }
 
 int
@@ -1284,13 +1288,13 @@ _pfctl_clear_states(int dev, const struct pfctl_kill *kill,
 	nvlist_add_bool(nvl, "kill_match", kill->kill_match);
 
 	if ((ret = pfctl_do_ioctl(dev, ioctlval, 1024, &nvl)) != 0)
-		return (ret);
+		goto out;
 
 	if (killed)
 		*killed = nvlist_get_number(nvl, "killed");
 
+out:
 	nvlist_destroy(nvl);
-
 	return (ret);
 }
 
@@ -1466,8 +1470,10 @@ pfctl_get_syncookies(int dev, struct pfctl_syncookies *s)
 
 	nvl = nvlist_create(0);
 
-	if ((ret = pfctl_do_ioctl(dev, DIOCGETSYNCOOKIES, 256, &nvl)) != 0)
-		return (errno);
+	if ((ret = pfctl_do_ioctl(dev, DIOCGETSYNCOOKIES, 256, &nvl)) != 0) {
+		ret = errno;
+		goto out;
+	}
 
 	enabled = nvlist_get_bool(nvl, "enabled");
 	adaptive = nvlist_get_bool(nvl, "adaptive");
@@ -1485,9 +1491,9 @@ pfctl_get_syncookies(int dev, struct pfctl_syncookies *s)
 	s->lowwater = nvlist_get_number(nvl, "lowwater") * 100 / state_limit;
 	s->halfopen_states = nvlist_get_number(nvl, "halfopen_states");
 
+out:
 	nvlist_destroy(nvl);
-
-	return (0);
+	return (ret);
 }
 
 int