pf: Fix match_rules memory leak

[vegeta_tuxpowered.net]

Summary

During evaluation of the ruleset by pf_test_rule() all "match" rules are
gathered in match_rules to be later copied into a state once a "pass"
rule finally accepts the packet.

When pf_create_state() fails due to hitting limits it terminates early
without calling pf_free_state(), as the state has not been allocated
yet. In such case free match_rules as the caller pf_test_rule() won't do
it.

[kp]

I failed to apply this patch, and I think it's because you already fixed this problem in https://cgit.freebsd.org/src/commit/?id=4d19eceaefb7106d761bc9504bb0da737ae0d674

Or am I missing something else?

[vegeta_tuxpowered.net]

In D43866#1000864, @kp wrote:

I failed to apply this patch, and I think it's because you already fixed this problem in https://cgit.freebsd.org/src/commit/?id=4d19eceaefb7106d761bc9504bb0da737ae0d674

Or am I missing something else?

This is absolutely embarrassing but I can explain myself :)

I've seen memory leaking on my systems running FreeBSD 14.0 , looked at the code for releng/14.0, found the leak, patched it… I forgot that I've worked on it already before, and the commit is not in release/14.0. I see it in stable/14, though. I'm abandoning this revision.

[kp]

In D43866#1000883, @vegeta_tuxpowered.net wrote:

In D43866#1000864, @kp wrote:

I failed to apply this patch, and I think it's because you already fixed this problem in https://cgit.freebsd.org/src/commit/?id=4d19eceaefb7106d761bc9504bb0da737ae0d674

Or am I missing something else?

This is absolutely embarrassing but I can explain myself :)

I've seen memory leaking on my systems running FreeBSD 14.0 , looked at the code for releng/14.0, found the leak, patched it… I forgot that I've worked on it already before, and the commit is not in release/14.0. I see it in stable/14, though. I'm abandoning this revision.

If it helps, I've had a very similar experience just last month, and also didn't notice until I found the commit that fixed the problem and discovered that it was mine.