diff options
| author | Florian Westphal <fw@strlen.de> | 2025-07-18 13:27:13 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-08-15 12:05:00 +0200 |
| commit | e18939176e657a3a20bfbed357b8c55a9f82aba3 (patch) | |
| tree | 522a13ea9f98e8f56ea02df465cb73cafab49cc2 /net/netfilter | |
| parent | 48002f79fee0b7d1ea5b074dd056e0faa12aae45 (diff) | |
| download | linux-e18939176e657a3a20bfbed357b8c55a9f82aba3.tar.gz linux-e18939176e657a3a20bfbed357b8c55a9f82aba3.tar.bz2 linux-e18939176e657a3a20bfbed357b8c55a9f82aba3.zip | |
netfilter: xt_nfacct: don't assume acct name is null-terminated
[ Upstream commit bf58e667af7d96c8eb9411f926a0a0955f41ce21 ]
BUG: KASAN: slab-out-of-bounds in .. lib/vsprintf.c:721
Read of size 1 at addr ffff88801eac95c8 by task syz-executor183/5851
[..]
string+0x231/0x2b0 lib/vsprintf.c:721
vsnprintf+0x739/0xf00 lib/vsprintf.c:2874
[..]
nfacct_mt_checkentry+0xd2/0xe0 net/netfilter/xt_nfacct.c:41
xt_check_match+0x3d1/0xab0 net/netfilter/x_tables.c:523
nfnl_acct_find_get() handles non-null input, but the error
printk relied on its presence.
Reported-by: syzbot+4ff165b9251e4d295690@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=4ff165b9251e4d295690
Tested-by: syzbot+4ff165b9251e4d295690@syzkaller.appspotmail.com
Fixes: ceb98d03eac5 ("netfilter: xtables: add nfacct match to support extended accounting")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'net/netfilter')
| -rw-r--r-- | net/netfilter/xt_nfacct.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/net/netfilter/xt_nfacct.c b/net/netfilter/xt_nfacct.c index 7c6bf1c16813..0ca1cdfc4095 100644 --- a/net/netfilter/xt_nfacct.c +++ b/net/netfilter/xt_nfacct.c @@ -38,8 +38,8 @@ nfacct_mt_checkentry(const struct xt_mtchk_param *par) nfacct = nfnl_acct_find_get(par->net, info->name); if (nfacct == NULL) { - pr_info_ratelimited("accounting object `%s' does not exists\n", - info->name); + pr_info_ratelimited("accounting object `%.*s' does not exist\n", + NFACCT_NAME_MAX, info->name); return -ENOENT; } info->nfacct = nfacct; |