pf: Improve input validation

[kp]

Summary

If we pass an anchor name which doesn't exist pfr_table_count() returns
-1, which leads to an overflow in mallocarray() and thus a panic.

Explicitly check that pfr_table_count() does not return an error.

Reported-by: [e-mail]

[melifaro]

LGTM, please see minor comments in the diff

sys/netpfil/pf/pf_ioctl.c

3058 ↗

(On Diff #70889)

I'm curious: it looks like pfr_get_tstats() uses totally separate routine to clear the statistics. Would it potentially make sense to use read lock to get the stats first and then clear the stats under wlock if the flag is specified?

3060 ↗

(On Diff #70889)

I'm wondering what will happen when n equals 0?
Do mallocarray() always return NULL?

[kp]

sys/netpfil/pf/pf_ioctl.c

3058 ↗

(On Diff #70889)

That would break the atomicity of the read+clear operation. We'd risk missing matches that happen between reading the stats and clearing them.

3060 ↗

(On Diff #70889)

That becomes a malloc(0, ...), so I believe we still allocate something, possibly rounded up to the smallest uma bucket size.