The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=64327f769cee0c26e1b81e6195a5092498b10403
commit 64327f769cee0c26e1b81e6195a5092498b10403 Author: Kristof Provost <[email protected]> AuthorDate: 2026-05-21 08:13:24 +0000 Commit: Kristof Provost <[email protected]> CommitDate: 2026-05-21 21:19:49 +0000 pf: fix incorrect table decoding in netlink We used nla_p_table for pfr_table structures, but this netlink decoder was intended for pfioc_table and decoded an extra field, outside of pfr_table. This allowed userspace to write (slightly) outside of pfr_table. Use a separate nlattr_parser for pfr_table. PR: 295218 Reported by: Robert Morris <[email protected]> MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") --- sys/netpfil/pf/pf_nl.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/sys/netpfil/pf/pf_nl.c b/sys/netpfil/pf/pf_nl.c index d1beb7681c21..0e1c77864615 100644 --- a/sys/netpfil/pf/pf_nl.c +++ b/sys/netpfil/pf/pf_nl.c @@ -2189,7 +2189,14 @@ nlattr_get_pfr_addr(struct nlattr *nla, struct nl_pstate *npt, const void *arg, return (0); } -NL_DECLARE_ATTR_PARSER(nested_table_parser, nla_p_table); +#define _OUT(_field) offsetof(struct pfr_table, _field) +static const struct nlattr_parser nla_p_pfrtable[] = { + { .type = PF_T_ANCHOR, .off = _OUT(pfrt_anchor), .arg = (void *)MAXPATHLEN, .cb = nlattr_get_chara }, + { .type = PF_T_NAME, .off = _OUT(pfrt_name), .arg = (void *)PF_TABLE_NAME_SIZE, .cb = nlattr_get_chara }, + { .type = PF_T_TABLE_FLAGS, .off = _OUT(pfrt_flags), .cb = nlattr_get_uint32 }, +}; +#undef _OUT +NL_DECLARE_ATTR_PARSER(nested_table_parser, nla_p_pfrtable); #define _OUT(_field) offsetof(struct nl_parsed_table_addrs, _field) static const struct nlattr_parser nla_p_table_addr[] = {
