The branch stable/15 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=1910f18b00fcda5e5b64087d5da140bc2ec7f779
commit 1910f18b00fcda5e5b64087d5da140bc2ec7f779 Author: Mark Johnston <[email protected]> AuthorDate: 2025-12-08 14:09:02 +0000 Commit: Mark Johnston <[email protected]> CommitDate: 2025-12-15 14:10:13 +0000 pf: Fix error handling in pf_handle_get_tstats() - pfr_table_count() can return an error. - We must check for failure from mallocarray(M_NOWAIT). Fixes: 9e8d2962aad3 ("pf: convert DIOCRGETTSTATS to netlink") Reported by: Kevin Day <[email protected]> Reviewed by: kp MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D54094 (cherry picked from commit 0f0662c6b4cc611d6e400f823656f908ffce5c04) --- sys/netpfil/pf/pf_nl.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/sys/netpfil/pf/pf_nl.c b/sys/netpfil/pf/pf_nl.c index 98d79729fb18..9fc3c67bfb58 100644 --- a/sys/netpfil/pf/pf_nl.c +++ b/sys/netpfil/pf/pf_nl.c @@ -1950,8 +1950,18 @@ pf_handle_get_tstats(struct nlmsghdr *hdr, struct nl_pstate *npt) PF_RULES_RLOCK(); n = pfr_table_count(&attrs.pfrio_table, attrs.pfrio_flags); + if (n < 0) { + PF_RULES_RUNLOCK(); + PF_TABLE_STATS_UNLOCK(); + return (EINVAL); + } pfrtstats = mallocarray(n, sizeof(struct pfr_tstats), M_PF, M_NOWAIT | M_ZERO); + if (pfrtstats == NULL) { + PF_RULES_RUNLOCK(); + PF_TABLE_STATS_UNLOCK(); + return (ENOMEM); + } error = pfr_get_tstats(&attrs.pfrio_table, pfrtstats, &n, attrs.pfrio_flags | PFR_FLAG_USERIOCTL);
