move down pf_tag_unref() calls in pf_rm_rule() to after the check wetehr there

are still states for the given rule existant.
based on a very nice analysis from cedric@, that is so completely right that
I have nothing to add:

in pf_rm_rule(), the pf_tag_unref() calls are done *before*
the if (rule->states > 0 || rule->entries.tqe_prev != NULL) test.

That mean that the two pf_tag_unref() calls could occur *twice*
for a given rule: first when the rule is removed from the ruleset
and (if the rule was kept around because of a state) a second
time when the state refcount drops to zero and the rule gets
really deleted. Unless I'm mistaken, that breaks the refcounting.

...and cedric was not mistaken.
and, as daniel pointed out:
The breakage this causes is so subtle, I doubt anyone noticed it before, if it
did occur.

consensus on this between cedric, dhartmei and myself

0 files changed, 0 insertions, 0 deletions