{"id":2227802,"url":"http://patchwork.ozlabs.org/api/patches/2227802/?format=json","web_url":"http://patchwork.ozlabs.org/project/netfilter-devel/patch/4e714f6189f9691fa5980087ce378a57cf625976.1776834093.git.rakukuip@gmail.com/","project":{"id":26,"url":"http://patchwork.ozlabs.org/api/projects/26/?format=json","name":"Netfilter Development","link_name":"netfilter-devel","list_id":"netfilter-devel.vger.kernel.org","list_email":"netfilter-devel@vger.kernel.org","web_url":null,"scm_url":null,"webscm_url":null,"list_archive_url":"","list_archive_url_format":"","commit_url_format":""},"msgid":"<4e714f6189f9691fa5980087ce378a57cf625976.1776834093.git.rakukuip@gmail.com>","list_archive_url":null,"date":"2026-04-24T09:23:00","name":"[nf,1/1] netfilter: ebtables: fix OOB read in compat_mtw_from_user","commit_ref":null,"pull_url":null,"state":"new","archived":false,"hash":"142f863ec8dab4b2d62d538c00c54389e877fd13","submitter":{"id":92912,"url":"http://patchwork.ozlabs.org/api/people/92912/?format=json","name":"Ren Wei","email":"n05ec@lzu.edu.cn"},"delegate":null,"mbox":"http://patchwork.ozlabs.org/project/netfilter-devel/patch/4e714f6189f9691fa5980087ce378a57cf625976.1776834093.git.rakukuip@gmail.com/mbox/","series":[{"id":501329,"url":"http://patchwork.ozlabs.org/api/series/501329/?format=json","web_url":"http://patchwork.ozlabs.org/project/netfilter-devel/list/?series=501329","date":"2026-04-24T09:23:00","name":"[nf,1/1] netfilter: ebtables: fix OOB read in compat_mtw_from_user","version":1,"mbox":"http://patchwork.ozlabs.org/series/501329/mbox/"}],"comments":"http://patchwork.ozlabs.org/api/patches/2227802/comments/","check":"pending","checks":"http://patchwork.ozlabs.org/api/patches/2227802/checks/","tags":{},"related":[],"headers":{"Return-Path":"\n ","X-Original-To":["incoming@patchwork.ozlabs.org","netfilter-devel@vger.kernel.org"],"Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c0a:e001:db::12fc:5321; helo=sea.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-12169-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)","smtp.subspace.kernel.org;\n arc=none smtp.client-ip=207.46.229.174","smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=lzu.edu.cn","smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=lzu.edu.cn"],"Received":["from sea.lore.kernel.org (sea.lore.kernel.org\n [IPv6:2600:3c0a:e001:db::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g278f5bypz1yDD\n\tfor ; Fri, 24 Apr 2026 19:34:42 +1000 (AEST)","from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sea.lore.kernel.org (Postfix) with ESMTP id 912CB301808E\n\tfor ; Fri, 24 Apr 2026 09:32:06 +0000 (UTC)","from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id 100283890F1;\n\tFri, 24 Apr 2026 09:32:06 +0000 (UTC)","from azure-sdnproxy.icoremail.net (azure-sdnproxy.icoremail.net\n [207.46.229.174])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id 321E218AFE\n\tfor ; Fri, 24 Apr 2026 09:32:02 +0000 (UTC)","from enjou-Legion-Y7000P-2019.coin-barley.ts.net (unknown\n [172.23.56.36])\n\tby app2 (Coremail) with SMTP id zQmowAAnv4VvOOtpjelCAA--.34880S3;\n\tFri, 24 Apr 2026 17:31:30 +0800 (CST)"],"ARC-Seal":"i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1777023125; cv=none;\n b=AUUMN5Q/3+SxqXx7TXPmFX71wqgIKUN60j+jppcoHeiNbhG5DHPmYOIzYF7MwbGn1yqRUCz+lD0c5L9HmbJHN7/bFV67s6BCRSgzDf7q1l/z5LMN6Jm1z1maO5Ij328OH119R/H4xBqf+JECNo7Y4blEic+yf8BEfM9k/FJ3zt4=","ARC-Message-Signature":"i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1777023125; c=relaxed/simple;\n\tbh=HV/HOmPr269yunyJbzTMG2ZKw9gGFaMudjaLHdZhMt8=;\n\th=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:\n\t MIME-Version;\n b=NoqqQ7DGtb3avUKT6J83EIoc08MqZSC7dZm0inNTOjL/OMFwijGMWCf3JVuABx8ZQ8e3YD11MPaSf+niZvoIlbA+rm7hB1jd2riHeegGrlEyotCQj4IFsis8/92OStXdFvZBeLHSN52cFxp1d+IlYhQAh08RJpQ0378owDaHKho=","ARC-Authentication-Results":"i=1; smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=lzu.edu.cn;\n spf=pass smtp.mailfrom=lzu.edu.cn; arc=none smtp.client-ip=207.46.229.174","From":"Ren Wei ","To":"netfilter-devel@vger.kernel.org,\n\tbridge@lists.linux.dev","Cc":"pablo@netfilter.org,\n\tfw@strlen.de,\n\tphil@nwl.cc,\n\trazor@blackwall.org,\n\tidosch@nvidia.com,\n\tdavem@davemloft.net,\n\tedumazet@google.com,\n\tkuba@kernel.org,\n\tpabeni@redhat.com,\n\thorms@kernel.org,\n\tyuantan098@gmail.com,\n\tyifanwucs@gmail.com,\n\ttomapufckgml@gmail.com,\n\tbird@lzu.edu.cn,\n\trakukuip@gmail.com,\n\tn05ec@lzu.edu.cn","Subject":"[PATCH nf 1/1] netfilter: ebtables: fix OOB read in\n compat_mtw_from_user","Date":"Fri, 24 Apr 2026 17:23:00 +0800","Message-ID":"\n <4e714f6189f9691fa5980087ce378a57cf625976.1776834093.git.rakukuip@gmail.com>","X-Mailer":"git-send-email 2.51.0","In-Reply-To":"","References":"","Precedence":"bulk","X-Mailing-List":"netfilter-devel@vger.kernel.org","List-Id":"","List-Subscribe":"","List-Unsubscribe":"","MIME-Version":"1.0","Content-Transfer-Encoding":"8bit","X-CM-TRANSID":"zQmowAAnv4VvOOtpjelCAA--.34880S3","X-Coremail-Antispam":"1UD129KBjvJXoW7Aw18XrWxJw43WF4kZF4kCrg_yoW8urWxpF\n\t9rCr13KFWaqry3t3s2y340vFWUWrs7W39xAr97G3s7Wr18KF1jyw1rKasxuF98Xas5ur45\n\tGF1qvr1Sk3y7ArJanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2\n\t9KBjDU0xBIdaVrnRJUUUBY1xkIjI8I6I8E6xAIw20EY4v20xvaj40_Wr0E3s1l1IIY67AE\n\tw4v_Jr0_Jr4l8cAvFVAK0II2c7xJM28CjxkF64kEwVA0rcxSw2x7M28EF7xvwVC0I7IYx2\n\tIY67AKxVW7JVWDJwA2z4x0Y4vE2Ix0cI8IcVCY1x0267AKxVW8Jr0_Cr1UM28EF7xvwVC2\n\tz280aVAFwI0_GcCE3s1l84ACjcxK6I8E87Iv6xkF7I0E14v26rxl6s0DM2AIxVAIcxkEcV\n\tAq07x20xvEncxIr21l5I8CrVACY4xI64kE6c02F40Ex7xfMcIj6xIIjxv20xvE14v26r1j\n\t6r18McIj6I8E87Iv67AKxVWUJVW8JwAm72CE4IkC6x0Yz7v_Jr0_Gr1lF7xvr2IYc2Ij64\n\tvIr41lF7I21c0EjII2zVCS5cI20VAGYxC7M4IIrI8v6xkF7I0E8cxan2IY04v7MxkF7I0E\n\tn4kS14v26r4a6rW5MxkIecxEwVCm-wCF04k20xvY0x0EwIxGrwCF04k20xvE74AGY7Cv6c\n\tx26r48MxC20s026xCaFVCjc4AY6r1j6r4UMI8I3I0E5I8CrVAFwI0_Jr0_Jr4lx2IqxVCj\n\tr7xvwVAFwI0_JrI_JrWlx4CE17CEb7AF67AKxVW8ZVWrXwCIc40Y0x0EwIxGrwCI42IY6x\n\tIIjxv20xvE14v26r1j6r1xMIIF0xvE2Ix0cI8IcVCY1x0267AKxVW8JVWxJwCI42IY6xAI\n\tw20EY4v20xvaj40_Jr0_JF4lIxAIcVC2z280aVAFwI0_Jr0_Gr1lIxAIcVC2z280aVCY1x\n\t0267AKxVW8JVW8JrUvcSsGvfC2KfnxnUUI43ZEXa7sRi_HU3UUUUU==","X-CM-SenderInfo":"zqqvvuo6o23hxhgxhubq/1tbiAQsHCWnrLmIBQwAAsI"},"content":"From: Luxiao Xu \n\nThe function compat_mtw_from_user() converts ebtables extensions from\n32-bit user structures to kernel native structures. However, it lacks\nproper validation of the user-supplied match_size/target_size.\n\nWhen certain extensions are processed, the kernel-side translation\nlogic may perform memory accesses based on the extension's expected\nsize. If the user provides a size smaller than what the extension\nrequires, it results in an out-of-bounds read as reported by KASAN.\n\nThis fix introduces a check to ensure match_size is at least as large\nas the extension's required compatsize. This covers matches, watchers,\nand targets, while maintaining compatibility with standard targets.\n\nFixes: 81e675c227ec (\"netfilter: ebtables: add CONFIG_COMPAT support\")\nCc: stable@kernel.org\nReported-by: Yuan Tan \nReported-by: Yifan Wu \nReported-by: Juefei Pu \nReported-by: Xin Liu \nSigned-off-by: Luxiao Xu \nSigned-off-by: Ren Wei \n---\n net/bridge/netfilter/ebtables.c | 11 +++++++++++\n 1 file changed, 11 insertions(+)","diff":"diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c\nindex aea3e19875c6..80cd0233c088 100644\n--- a/net/bridge/netfilter/ebtables.c\n+++ b/net/bridge/netfilter/ebtables.c\n@@ -1977,6 +1977,11 @@ static int compat_mtw_from_user(const struct compat_ebt_entry_mwt *mwt,\n \t\tif (IS_ERR(match))\n \t\t\treturn PTR_ERR(match);\n \n+\t\tif (match_size < match->compatsize) {\n+\t\t\tmodule_put(match->me);\n+\t\t\treturn -EINVAL;\n+\t\t}\n+\n \t\toff = ebt_compat_match_offset(match, match_size);\n \t\tif (dst) {\n \t\t\tif (match->compat_from_user)\n@@ -1996,6 +2001,12 @@ static int compat_mtw_from_user(const struct compat_ebt_entry_mwt *mwt,\n \t\t\t\t\t mwt->u.revision);\n \t\tif (IS_ERR(wt))\n \t\t\treturn PTR_ERR(wt);\n+\n+\t\tif (match_size < wt->compatsize) {\n+\t\t\tmodule_put(wt->me);\n+\t\t\treturn -EINVAL;\n+\t\t}\n+\n \t\toff = xt_compat_target_offset(wt);\n \n \t\tif (dst) {\n","prefixes":["nf","1/1"]}