linux-stable/net
Florian Westphal b10cfa2de1 netfilter: xt_nfacct: don't assume acct name is null-terminated
[ Upstream commit bf58e667af ]

BUG: KASAN: slab-out-of-bounds in .. lib/vsprintf.c:721
Read of size 1 at addr ffff88801eac95c8 by task syz-executor183/5851
[..]
 string+0x231/0x2b0 lib/vsprintf.c:721
 vsnprintf+0x739/0xf00 lib/vsprintf.c:2874
 [..]
 nfacct_mt_checkentry+0xd2/0xe0 net/netfilter/xt_nfacct.c:41
 xt_check_match+0x3d1/0xab0 net/netfilter/x_tables.c:523

nfnl_acct_find_get() handles non-null input, but the error
printk relied on its presence.

Reported-by: syzbot+4ff165b9251e4d295690@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=4ff165b9251e4d295690
Tested-by: syzbot+4ff165b9251e4d295690@syzkaller.appspotmail.com
Fixes: ceb98d03ea ("netfilter: xtables: add nfacct match to support extended accounting")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-08-28 16:24:09 +02:00
..
6lowpan
9p
802
8021q net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime 2025-08-28 16:24:02 +02:00
appletalk net: appletalk: Fix use-after-free in AARP proxy probe 2025-08-28 16:24:04 +02:00
atm atm: clip: Fix NULL pointer dereference in vcc_sendmsg() 2025-07-17 18:30:47 +02:00
ax25
batman-adv
bluetooth Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU 2025-08-28 16:24:02 +02:00
bpf
bpfilter
bridge net: bridge: Do not offload IGMP/MLD messages 2025-08-28 16:24:02 +02:00
caif caif: reduce stack size, again 2025-08-28 16:24:07 +02:00
can can: bcm: add missing rcu read protection for procfs content 2025-06-04 14:38:06 +02:00
ceph
core bpf, sockmap: Fix psock incorrectly pointing to sk 2025-08-28 16:24:07 +02:00
dcb
dccp
dns_resolver
dsa net: dsa: tag_brcm: legacy: fix pskb_may_pull length 2025-06-27 11:05:17 +01:00
ethernet
ethtool
hsr
ieee802154
ife
ipv4 tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range 2025-08-28 16:24:07 +02:00
ipv6 ipv6: mcast: Delay put pmc->idev in mld_del_delrec() 2025-08-28 16:24:02 +02:00
iucv
kcm
key
l2tp
l3mdev
lapb
llc llc: fix data loss when reading from a socket in llc_ui_recvmsg() 2025-06-04 14:38:06 +02:00
mac80211 Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" 2025-08-28 16:24:08 +02:00
mac802154
mctp
mpls mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). 2025-06-27 11:05:36 +01:00
mptcp
ncsi net: ncsi: Fix GCPS 64-bit member variables 2025-06-27 11:05:12 +01:00
netfilter netfilter: xt_nfacct: don't assume acct name is null-terminated 2025-08-28 16:24:09 +02:00
netlabel calipso: unlock rcu before returning -EAFNOSUPPORT 2025-06-27 11:05:22 +01:00
netlink netlink: make sure we allow at least one dump skb 2025-07-17 18:30:50 +02:00
netrom
nfc NFC: nci: uart: Set tty->disc_data only in success path 2025-06-27 11:05:25 +01:00
nsh
openvswitch net: openvswitch: Fix the dead loop of MPLS parse 2025-06-27 11:05:14 +01:00
packet af_packet: fix soft lockup issue caused by tpacket_snd() 2025-08-28 16:23:59 +02:00
phonet phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() 2025-08-28 16:23:59 +02:00
psample
qrtr
rds
rfkill
rose rose: fix dangling neighbour pointers in rose_rt_device_down() 2025-07-10 15:57:46 +02:00
rxrpc rxrpc: Fix oops due to non-existence of prealloc backlog struct 2025-07-17 18:30:48 +02:00
sched net_sched: act_ctinfo: use atomic64_t for three counters 2025-08-28 16:24:08 +02:00
sctp sctp: Do not wake readers in __sctp_write_space() 2025-06-27 11:05:31 +01:00
smc
strparser
sunrpc sunrpc: fix race in cache cleanup causing stale nextcheck time 2025-06-27 11:05:29 +01:00
switchdev
tipc tipc: Fix use-after-free in tipc_conn_close(). 2025-07-17 18:30:46 +02:00
tls bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls 2025-08-28 16:24:07 +02:00
unix af_unix: Don't set -ECONNRESET for consumed OOB skb. 2025-07-10 15:57:38 +02:00
vmw_vsock vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also transport_local 2025-07-17 18:30:46 +02:00
wireless
x25
xdp
xfrm xfrm: Sanitize marks before insert 2025-06-04 14:38:05 +02:00
compat.c
devres.c
Kconfig
Makefile
socket.c
sysctl_net.c