diff mbox series

netfilter: nft_nat: fully initialise new_addr in netmap setup

Message ID 20260825091056.253147-1-theodorlarionov@gmail.com
State New
Headers show
Series netfilter: nft_nat: fully initialise new_addr in netmap setup | expand

Commit Message

Theodor Arsenij Larionov Trichkine Aug. 25, 2026, 9:10 a.m. UTC 
nft_nat_setup_netmap() builds the mapped address in an on-stack
union nf_inet_addr. For an IPv4 mapping it writes only the 4-byte .ip
member and the loop runs a single 32-bit iteration, but it then copies
the whole 16-byte union into range->min_addr and range->max_addr, so the
upper 12 bytes reach nf_nat_setup_info() uninitialised.

KMSAN reports an uninit-value in nf_nat_setup_info() reached from
nft_nat_eval(). The IPv6 path fills all 16 bytes and is not affected.

Zero-initialise new_addr.

Fixes: 3ff7ddb1353d ("netfilter: nft_nat: add netmap support")
Signed-off-by: Theodor Arsenij Larionov Trichkine <theodorlarionov@gmail.com>
---
 net/netfilter/nft_nat.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)


base-commit: 7cbfb180945ce529608e4d4e24a6d483699fab1e
diff mbox series

Patch

diff --git a/net/netfilter/nft_nat.c b/net/netfilter/nft_nat.c
index e32cd9fbc7c2e..7b026305b5fea 100644
--- a/net/netfilter/nft_nat.c
+++ b/net/netfilter/nft_nat.c
@@ -65,7 +65,7 @@  static void nft_nat_setup_netmap(struct nf_nat_range2 *range,
 				 const struct nft_nat *priv)
 {
 	struct sk_buff *skb = pkt->skb;
-	union nf_inet_addr new_addr;
+	union nf_inet_addr new_addr = {};
 	__be32 netmask;
 	int i, len = 0;