git: 45aaba521c3b - stable/15 - pf: fix incorrect table decoding in netlink

The branch stable/15 has been updated by kp:

URL: https://cgit.FreeBSD.org/src/commit/?id=45aaba521c3b7abd39dc9e8f5ed0e9521fee57c3

commit 45aaba521c3b7abd39dc9e8f5ed0e9521fee57c3
Author:     Kristof Provost <kp@FreeBSD.org>
AuthorDate: 2026-05-21 08:13:24 +0000
Commit:     Kristof Provost <kp@FreeBSD.org>
CommitDate: 2026-05-28 11:36:43 +0000

    pf: fix incorrect table decoding in netlink
    
    We used nla_p_table for pfr_table structures, but this netlink decoder
    was intended for pfioc_table and decoded an extra field, outside
    of pfr_table. This allowed userspace to write (slightly) outside of
    pfr_table.
    
    Use a separate nlattr_parser for pfr_table.
    
    PR:             295218
    Reported by:    Robert Morris <rtm@lcs.mit.edu>
    MFC after:      1 week
    Sponsored by:   Rubicon Communications, LLC ("Netgate")
    
    (cherry picked from commit 64327f769cee0c26e1b81e6195a5092498b10403)
---
 sys/netpfil/pf/pf_nl.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/sys/netpfil/pf/pf_nl.c b/sys/netpfil/pf/pf_nl.c
index 168c6ac63d90..c09b204bcc66 100644
--- a/sys/netpfil/pf/pf_nl.c
+++ b/sys/netpfil/pf/pf_nl.c
@@ -2138,7 +2138,14 @@ nlattr_get_pfr_addr(struct nlattr *nla, struct nl_pstate *npt, const void *arg,
 	return (0);
 }
 
-NL_DECLARE_ATTR_PARSER(nested_table_parser, nla_p_table);
+#define _OUT(_field)	offsetof(struct pfr_table, _field)
+static const struct nlattr_parser nla_p_pfrtable[] = {
+	{ .type = PF_T_ANCHOR, .off = _OUT(pfrt_anchor), .arg = (void *)MAXPATHLEN, .cb = nlattr_get_chara },
+	{ .type = PF_T_NAME, .off = _OUT(pfrt_name), .arg = (void *)PF_TABLE_NAME_SIZE, .cb = nlattr_get_chara },
+	{ .type = PF_T_TABLE_FLAGS, .off = _OUT(pfrt_flags), .cb = nlattr_get_uint32 },
+};
+#undef _OUT
+NL_DECLARE_ATTR_PARSER(nested_table_parser, nla_p_pfrtable);
 
 #define _OUT(_field)	offsetof(struct nl_parsed_table_addrs, _field)
 static const struct nlattr_parser nla_p_table_addr[] = {