git: 68513b4102dc - stable/14 - pf: Free pf_rule_items when state is not created

The branch stable/14 has been updated by kp:

URL: https://cgit.FreeBSD.org/src/commit/?id=68513b4102dc75a9f4ca49692f97be721e407f0c

commit 68513b4102dc75a9f4ca49692f97be721e407f0c
Author:     Kajetan Staszkiewicz <vegeta@tuxpowered.net>
AuthorDate: 2023-10-12 17:43:04 +0000
Commit:     Kristof Provost <kp@FreeBSD.org>
CommitDate: 2023-10-19 07:29:05 +0000

    pf: Free pf_rule_items when state is not created
    
    This addresses the issues of pf_rule_times leaking in case of stateless
    rules and in case of state creation failures, like hitting the state
    limit.
    
    Reviewed by:    kp
    MFC after:      1 week
    Sponsored by:   InnoGames GmbH
    Differential Revision:  https://reviews.freebsd.org/D42169
    
    (cherry picked from commit 4d19eceaefb7106d761bc9504bb0da737ae0d674)
---
 sys/netpfil/pf/pf.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c
index 3dddfdd0b1a4..39d240f49dbd 100644
--- a/sys/netpfil/pf/pf.c
+++ b/sys/netpfil/pf/pf.c
@@ -4731,6 +4731,11 @@ pf_test_rule(struct pf_krule **rm, struct pf_kstate **sm, struct pfi_kkif *kif,
 			return (action);
 		}
 	} else {
+		while ((ri = SLIST_FIRST(&match_rules))) {
+			SLIST_REMOVE_HEAD(&match_rules, entry);
+			free(ri, M_PF_RULE_ITEM);
+		}
+
 		uma_zfree(V_pf_state_key_z, sk);
 		uma_zfree(V_pf_state_key_z, nk);
 	}
@@ -4776,6 +4781,7 @@ pf_create_state(struct pf_krule *r, struct pf_krule *nr, struct pf_krule *a,
 	struct tcphdr		*th = &pd->hdr.tcp;
 	u_int16_t		 mss = V_tcp_mssdflt;
 	u_short			 reason, sn_reason;
+	struct pf_krule_item	*ri;
 
 	/* check maximums */
 	if (r->max_states &&
@@ -4986,6 +4992,11 @@ pf_create_state(struct pf_krule *r, struct pf_krule *nr, struct pf_krule *a,
 	return (PF_PASS);
 
 csfailed:
+	while ((ri = SLIST_FIRST(match_rules))) {
+		SLIST_REMOVE_HEAD(match_rules, entry);
+		free(ri, M_PF_RULE_ITEM);
+	}
+
 	uma_zfree(V_pf_state_key_z, sk);
 	uma_zfree(V_pf_state_key_z, nk);