pf: ensure we don't destroy an uninitialised lock

The new lock introduced in 5f5e32f needs to be initialised early so
that it can be safely destroyed if we error out.

Reported-by: [email protected]
MFC after:	3 weeks
Sponsored by:	Rubicon Communications, LLC ("Netgate")

(cherry picked from commit e5ca5e8)

sys/netpfil/pf/pf_ioctl.c

@@ -2009,6 +2009,8 @@ pf_ioctl_addrule(struct pf_krule *rule, uint32_t ticket,
 	int			 rs_num;
 	int			 error = 0;
 
+	mtx_init(&rule->rpool.mtx, "pf_krule_pool", NULL, MTX_DEF);
+
 	if ((rule->return_icmp >> 8) > ICMP_MAXTYPE) {
 		error = EINVAL;
 		goto errout_unlocked;
@@ -2149,7 +2151,6 @@ pf_ioctl_addrule(struct pf_krule *rule, uint32_t ticket,
 	    rule, entries);
 	ruleset->rules[rs_num].inactive.rcount++;
 
-	mtx_init(&rule->rpool.mtx, "pf_krule_pool", NULL, MTX_DEF);
 	PF_RULES_WUNLOCK();
 
 	return (0);