pf :Use counter(9) in pf tables.

[kp]

Summary

The counters of pf tables are updated outside the rule lock. That means state
updates might overwrite each other. Furthermore allocation and
freeing of counters happens outside the lock as well.

Use counter(9) for the counters, and always allocate the counter table
element, so that the race condition cannot happen any more.

Submitted by: Kajetan Staszkiewicz <[e-mail]>
PR: 230619

[glebius]

sys/netpfil/pf/pf_table.c

794

Let's put a comment that previous allocation isn't leaked, since any failure of ​pfr_create_kentry_counter() is followed by pfr_destroy_kentry(ke).

[kp]

Add comment