Re: pf: use-after-free and table leak in pf_sourcelim_add()

Hello,

On Fri, Apr 10, 2026 at 09:56:26AM +0200, Renaud Allard wrote:
</snip>
> 
> Index: sys/net/pf_ioctl.c
> ===================================================================
> --- sys/net/pf_ioctl.c
> +++ sys/net/pf_ioctl.c
> @@ -1576,8 +1576,8 @@ pf_sourcelim_add(const struct pfioc_sour
> 
>  	if (RBT_INSERT(pf_sourcelim_nm_tree,
>  	    &pf_sourcelim_nm_tree_inactive, pfsrlim) != NULL) {
> -		RBT_INSERT(pf_sourcelim_nm_tree,
> -		    &pf_sourcelim_nm_tree_inactive, pfsrlim);
> +		RBT_REMOVE(pf_sourcelim_id_tree,
> +		    &pf_sourcelim_id_tree_inactive, pfsrlim);
>  		error = EBUSY;
>  		goto unlock;
>  	}

    this is well spotted and I agree the change is desired.

> @@ -1590,6 +1590,8 @@ pf_sourcelim_add(const struct pfioc_sour
>  	return (0);
> 
>  unlock:
> +	if (pfsrlim->pfsrlim_overload.table != NULL)
> +		pfr_detach_table(pfsrlim->pfsrlim_overload.table);


    I think this needs to be moved to the free: goto target below. 

>  	PF_UNLOCK();
>  	NET_UNLOCK();
>  free:
> 

thanks and
regards
sashan