Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/2227802/?format=api
{ "id": 2227802, "url": "http://patchwork.ozlabs.org/api/patches/2227802/?format=api", "web_url": "http://patchwork.ozlabs.org/project/netfilter-devel/patch/4e714f6189f9691fa5980087ce378a57cf625976.1776834093.git.rakukuip@gmail.com/", "project": { "id": 26, "url": "http://patchwork.ozlabs.org/api/projects/26/?format=api", "name": "Netfilter Development", "link_name": "netfilter-devel", "list_id": "netfilter-devel.vger.kernel.org", "list_email": "netfilter-devel@vger.kernel.org", "web_url": null, "scm_url": null, "webscm_url": null, "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<4e714f6189f9691fa5980087ce378a57cf625976.1776834093.git.rakukuip@gmail.com>", "list_archive_url": null, "date": "2026-04-24T09:23:00", "name": "[nf,1/1] netfilter: ebtables: fix OOB read in compat_mtw_from_user", "commit_ref": null, "pull_url": null, "state": "new", "archived": false, "hash": "142f863ec8dab4b2d62d538c00c54389e877fd13", "submitter": { "id": 92912, "url": "http://patchwork.ozlabs.org/api/people/92912/?format=api", "name": "Ren Wei", "email": "n05ec@lzu.edu.cn" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/netfilter-devel/patch/4e714f6189f9691fa5980087ce378a57cf625976.1776834093.git.rakukuip@gmail.com/mbox/", "series": [ { "id": 501329, "url": "http://patchwork.ozlabs.org/api/series/501329/?format=api", "web_url": "http://patchwork.ozlabs.org/project/netfilter-devel/list/?series=501329", "date": "2026-04-24T09:23:00", "name": "[nf,1/1] netfilter: ebtables: fix OOB read in compat_mtw_from_user", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/501329/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2227802/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2227802/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "\n <netfilter-devel+bounces-12169-incoming=patchwork.ozlabs.org@vger.kernel.org>", "X-Original-To": [ "incoming@patchwork.ozlabs.org", "netfilter-devel@vger.kernel.org" ], "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c0a:e001:db::12fc:5321; helo=sea.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-12169-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)", "smtp.subspace.kernel.org;\n arc=none smtp.client-ip=207.46.229.174", "smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=lzu.edu.cn", "smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=lzu.edu.cn" ], "Received": [ "from sea.lore.kernel.org (sea.lore.kernel.org\n [IPv6:2600:3c0a:e001:db::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g278f5bypz1yDD\n\tfor <incoming@patchwork.ozlabs.org>; Fri, 24 Apr 2026 19:34:42 +1000 (AEST)", "from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sea.lore.kernel.org (Postfix) with ESMTP id 912CB301808E\n\tfor <incoming@patchwork.ozlabs.org>; Fri, 24 Apr 2026 09:32:06 +0000 (UTC)", "from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id 100283890F1;\n\tFri, 24 Apr 2026 09:32:06 +0000 (UTC)", "from azure-sdnproxy.icoremail.net (azure-sdnproxy.icoremail.net\n [207.46.229.174])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id 321E218AFE\n\tfor <netfilter-devel@vger.kernel.org>; Fri, 24 Apr 2026 09:32:02 +0000 (UTC)", "from enjou-Legion-Y7000P-2019.coin-barley.ts.net (unknown\n [172.23.56.36])\n\tby app2 (Coremail) with SMTP id zQmowAAnv4VvOOtpjelCAA--.34880S3;\n\tFri, 24 Apr 2026 17:31:30 +0800 (CST)" ], "ARC-Seal": "i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1777023125; cv=none;\n b=AUUMN5Q/3+SxqXx7TXPmFX71wqgIKUN60j+jppcoHeiNbhG5DHPmYOIzYF7MwbGn1yqRUCz+lD0c5L9HmbJHN7/bFV67s6BCRSgzDf7q1l/z5LMN6Jm1z1maO5Ij328OH119R/H4xBqf+JECNo7Y4blEic+yf8BEfM9k/FJ3zt4=", "ARC-Message-Signature": "i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1777023125; c=relaxed/simple;\n\tbh=HV/HOmPr269yunyJbzTMG2ZKw9gGFaMudjaLHdZhMt8=;\n\th=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:\n\t MIME-Version;\n b=NoqqQ7DGtb3avUKT6J83EIoc08MqZSC7dZm0inNTOjL/OMFwijGMWCf3JVuABx8ZQ8e3YD11MPaSf+niZvoIlbA+rm7hB1jd2riHeegGrlEyotCQj4IFsis8/92OStXdFvZBeLHSN52cFxp1d+IlYhQAh08RJpQ0378owDaHKho=", "ARC-Authentication-Results": "i=1; smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=lzu.edu.cn;\n spf=pass smtp.mailfrom=lzu.edu.cn; arc=none smtp.client-ip=207.46.229.174", "From": "Ren Wei <n05ec@lzu.edu.cn>", "To": "netfilter-devel@vger.kernel.org,\n\tbridge@lists.linux.dev", "Cc": "pablo@netfilter.org,\n\tfw@strlen.de,\n\tphil@nwl.cc,\n\trazor@blackwall.org,\n\tidosch@nvidia.com,\n\tdavem@davemloft.net,\n\tedumazet@google.com,\n\tkuba@kernel.org,\n\tpabeni@redhat.com,\n\thorms@kernel.org,\n\tyuantan098@gmail.com,\n\tyifanwucs@gmail.com,\n\ttomapufckgml@gmail.com,\n\tbird@lzu.edu.cn,\n\trakukuip@gmail.com,\n\tn05ec@lzu.edu.cn", "Subject": "[PATCH nf 1/1] netfilter: ebtables: fix OOB read in\n compat_mtw_from_user", "Date": "Fri, 24 Apr 2026 17:23:00 +0800", "Message-ID": "\n <4e714f6189f9691fa5980087ce378a57cf625976.1776834093.git.rakukuip@gmail.com>", "X-Mailer": "git-send-email 2.51.0", "In-Reply-To": "<cover.1776834093.git.rakukuip@gmail.com>", "References": "<cover.1776834093.git.rakukuip@gmail.com>", "Precedence": "bulk", "X-Mailing-List": "netfilter-devel@vger.kernel.org", "List-Id": "<netfilter-devel.vger.kernel.org>", "List-Subscribe": "<mailto:netfilter-devel+subscribe@vger.kernel.org>", "List-Unsubscribe": "<mailto:netfilter-devel+unsubscribe@vger.kernel.org>", "MIME-Version": "1.0", "Content-Transfer-Encoding": "8bit", "X-CM-TRANSID": "zQmowAAnv4VvOOtpjelCAA--.34880S3", "X-Coremail-Antispam": "1UD129KBjvJXoW7Aw18XrWxJw43WF4kZF4kCrg_yoW8urWxpF\n\t9rCr13KFWaqry3t3s2y340vFWUWrs7W39xAr97G3s7Wr18KF1jyw1rKasxuF98Xas5ur45\n\tGF1qvr1Sk3y7ArJanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2\n\t9KBjDU0xBIdaVrnRJUUUBY1xkIjI8I6I8E6xAIw20EY4v20xvaj40_Wr0E3s1l1IIY67AE\n\tw4v_Jr0_Jr4l8cAvFVAK0II2c7xJM28CjxkF64kEwVA0rcxSw2x7M28EF7xvwVC0I7IYx2\n\tIY67AKxVW7JVWDJwA2z4x0Y4vE2Ix0cI8IcVCY1x0267AKxVW8Jr0_Cr1UM28EF7xvwVC2\n\tz280aVAFwI0_GcCE3s1l84ACjcxK6I8E87Iv6xkF7I0E14v26rxl6s0DM2AIxVAIcxkEcV\n\tAq07x20xvEncxIr21l5I8CrVACY4xI64kE6c02F40Ex7xfMcIj6xIIjxv20xvE14v26r1j\n\t6r18McIj6I8E87Iv67AKxVWUJVW8JwAm72CE4IkC6x0Yz7v_Jr0_Gr1lF7xvr2IYc2Ij64\n\tvIr41lF7I21c0EjII2zVCS5cI20VAGYxC7M4IIrI8v6xkF7I0E8cxan2IY04v7MxkF7I0E\n\tn4kS14v26r4a6rW5MxkIecxEwVCm-wCF04k20xvY0x0EwIxGrwCF04k20xvE74AGY7Cv6c\n\tx26r48MxC20s026xCaFVCjc4AY6r1j6r4UMI8I3I0E5I8CrVAFwI0_Jr0_Jr4lx2IqxVCj\n\tr7xvwVAFwI0_JrI_JrWlx4CE17CEb7AF67AKxVW8ZVWrXwCIc40Y0x0EwIxGrwCI42IY6x\n\tIIjxv20xvE14v26r1j6r1xMIIF0xvE2Ix0cI8IcVCY1x0267AKxVW8JVWxJwCI42IY6xAI\n\tw20EY4v20xvaj40_Jr0_JF4lIxAIcVC2z280aVAFwI0_Jr0_Gr1lIxAIcVC2z280aVCY1x\n\t0267AKxVW8JVW8JrUvcSsGvfC2KfnxnUUI43ZEXa7sRi_HU3UUUUU==", "X-CM-SenderInfo": "zqqvvuo6o23hxhgxhubq/1tbiAQsHCWnrLmIBQwAAsI" }, "content": "From: Luxiao Xu <rakukuip@gmail.com>\n\nThe function compat_mtw_from_user() converts ebtables extensions from\n32-bit user structures to kernel native structures. However, it lacks\nproper validation of the user-supplied match_size/target_size.\n\nWhen certain extensions are processed, the kernel-side translation\nlogic may perform memory accesses based on the extension's expected\nsize. If the user provides a size smaller than what the extension\nrequires, it results in an out-of-bounds read as reported by KASAN.\n\nThis fix introduces a check to ensure match_size is at least as large\nas the extension's required compatsize. This covers matches, watchers,\nand targets, while maintaining compatibility with standard targets.\n\nFixes: 81e675c227ec (\"netfilter: ebtables: add CONFIG_COMPAT support\")\nCc: stable@kernel.org\nReported-by: Yuan Tan <yuantan098@gmail.com>\nReported-by: Yifan Wu <yifanwucs@gmail.com>\nReported-by: Juefei Pu <tomapufckgml@gmail.com>\nReported-by: Xin Liu <bird@lzu.edu.cn>\nSigned-off-by: Luxiao Xu <rakukuip@gmail.com>\nSigned-off-by: Ren Wei <n05ec@lzu.edu.cn>\n---\n net/bridge/netfilter/ebtables.c | 11 +++++++++++\n 1 file changed, 11 insertions(+)", "diff": "diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c\nindex aea3e19875c6..80cd0233c088 100644\n--- a/net/bridge/netfilter/ebtables.c\n+++ b/net/bridge/netfilter/ebtables.c\n@@ -1977,6 +1977,11 @@ static int compat_mtw_from_user(const struct compat_ebt_entry_mwt *mwt,\n \t\tif (IS_ERR(match))\n \t\t\treturn PTR_ERR(match);\n \n+\t\tif (match_size < match->compatsize) {\n+\t\t\tmodule_put(match->me);\n+\t\t\treturn -EINVAL;\n+\t\t}\n+\n \t\toff = ebt_compat_match_offset(match, match_size);\n \t\tif (dst) {\n \t\t\tif (match->compat_from_user)\n@@ -1996,6 +2001,12 @@ static int compat_mtw_from_user(const struct compat_ebt_entry_mwt *mwt,\n \t\t\t\t\t mwt->u.revision);\n \t\tif (IS_ERR(wt))\n \t\t\treturn PTR_ERR(wt);\n+\n+\t\tif (match_size < wt->compatsize) {\n+\t\t\tmodule_put(wt->me);\n+\t\t\treturn -EINVAL;\n+\t\t}\n+\n \t\toff = xt_compat_target_offset(wt);\n \n \t\tif (dst) {\n", "prefixes": [ "nf", "1/1" ] }