6.6-stable patches

added patches:
	netfilter-ebtables-module-names-must-be-null-terminated.patch
	netfilter-ebtables-terminate-table-name-before-find_table_lock.patch

diff --git a/queue-6.6/netfilter-ebtables-module-names-must-be-null-terminated.patch b/queue-6.6/netfilter-ebtables-module-names-must-be-null-terminated.patch
new file mode 100644 (file)
index 0000000..f1d6053
--- /dev/null
+++ b/queue-6.6/netfilter-ebtables-module-names-must-be-null-terminated.patch
@@ -0,0 +1,32 @@
+From 084d23f818321390509e9738a0b08bbf46df6425 Mon Sep 17 00:00:00 2001
+From: Florian Westphal <fw@strlen.de>
+Date: Sat, 4 Jul 2026 12:05:15 +0200
+Subject: netfilter: ebtables: module names must be null-terminated
+
+From: Florian Westphal <fw@strlen.de>
+
+commit 084d23f818321390509e9738a0b08bbf46df6425 upstream.
+
+We need to explicitly check the length, else we may pass non-null
+terminated string to request_module().
+
+Cc: stable@vger.kernel.org
+Fixes: bcf493428840 ("netfilter: ebtables: Fix extension lookup with identical name")
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/bridge/netfilter/ebtables.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/bridge/netfilter/ebtables.c
++++ b/net/bridge/netfilter/ebtables.c
+@@ -402,6 +402,9 @@ ebt_check_match(struct ebt_entry_match *
+           left - sizeof(struct ebt_entry_match) < m->match_size)
+               return -EINVAL;
+ 
++      if (strnlen(m->u.name, XT_EXTENSION_MAXNAMELEN) == XT_EXTENSION_MAXNAMELEN)
++              return -EINVAL;
++
+       match = xt_find_match(NFPROTO_BRIDGE, m->u.name, m->u.revision);
+       if (IS_ERR(match) || match->family != NFPROTO_BRIDGE) {
+               if (!IS_ERR(match))

diff --git a/queue-6.6/netfilter-ebtables-terminate-table-name-before-find_table_lock.patch b/queue-6.6/netfilter-ebtables-terminate-table-name-before-find_table_lock.patch
new file mode 100644 (file)
index 0000000..7de9358
--- /dev/null
+++ b/queue-6.6/netfilter-ebtables-terminate-table-name-before-find_table_lock.patch
@@ -0,0 +1,77 @@
+From a622d2e9608c9dff47fc2e5759ac7aa3a836b45d Mon Sep 17 00:00:00 2001
+From: Xiang Mei <xmei5@asu.edu>
+Date: Sun, 5 Jul 2026 14:58:00 -0700
+Subject: netfilter: ebtables: terminate table name before find_table_lock()
+
+From: Xiang Mei <xmei5@asu.edu>
+
+commit a622d2e9608c9dff47fc2e5759ac7aa3a836b45d upstream.
+
+update_counters() and compat_update_counters() forward a user-supplied
+32-byte table name to find_table_lock() without NUL-terminating it. On a
+lookup miss, find_inlist_lock() calls try_then_request_module(..., "%s%s",
+"ebtable_", name), and vsnprintf() reads past the name field and the
+stack object until it hits a zero byte.
+
+  BUG: KASAN: stack-out-of-bounds in string (lib/vsprintf.c:648 lib/vsprintf.c:730)
+  Read of size 1 at addr ffff8880119dfb20 by task exploit/147
+  Call Trace:
+  ...
+   string (lib/vsprintf.c:648 lib/vsprintf.c:730)
+   vsnprintf (lib/vsprintf.c:2945)
+   __request_module (kernel/module/kmod.c:150)
+   do_update_counters.isra.0 (net/bridge/netfilter/ebtables.c:371 net/bridge/netfilter/ebtables.c:380)
+   update_counters (net/bridge/netfilter/ebtables.c:1440)
+   do_ebt_set_ctl (net/bridge/netfilter/ebtables.c:2573)
+   nf_setsockopt (net/netfilter/nf_sockopt.c:101)
+   ip_setsockopt (net/ipv4/ip_sockglue.c:1424)
+   raw_setsockopt (net/ipv4/raw.c:847)
+   __sys_setsockopt (net/socket.c:2393)
+  ...
+
+compat_do_replace() shares the same unterminated name via
+compat_copy_ebt_replace_from_user(); terminate it there too so all
+find_table_lock() callers behave alike. The other callers already
+terminate the name after the copy.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Fixes: 81e675c227ec ("netfilter: ebtables: add CONFIG_COMPAT support")
+Cc: stable@vger.kernel.org
+Reported-by: Weiming Shi <bestswngs@gmail.com>
+Assisted-by: Claude:claude-opus-4-8
+Signed-off-by: Xiang Mei <xmei5@asu.edu>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/bridge/netfilter/ebtables.c |    6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/net/bridge/netfilter/ebtables.c
++++ b/net/bridge/netfilter/ebtables.c
+@@ -1433,6 +1433,8 @@ static int update_counters(struct net *n
+       if (copy_from_sockptr(&hlp, arg, sizeof(hlp)))
+               return -EFAULT;
+ 
++      hlp.name[sizeof(hlp.name) - 1] = '\0';
++
+       if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter))
+               return -EINVAL;
+ 
+@@ -2272,6 +2274,8 @@ static int compat_copy_ebt_replace_from_
+ 
+       memcpy(repl, &tmp, offsetof(struct ebt_replace, hook_entry));
+ 
++      repl->name[sizeof(repl->name) - 1] = '\0';
++
+       /* starting with hook_entry, 32 vs. 64 bit structures are different */
+       for (i = 0; i < NF_BR_NUMHOOKS; i++)
+               repl->hook_entry[i] = compat_ptr(tmp.hook_entry[i]);
+@@ -2394,6 +2398,8 @@ static int compat_update_counters(struct
+       if (copy_from_sockptr(&hlp, arg, sizeof(hlp)))
+               return -EFAULT;
+ 
++      hlp.name[sizeof(hlp.name) - 1] = '\0';
++
+       /* try real handler in case userland supplied needed padding */
+       if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter))
+               return update_counters(net, arg, len);

diff --git a/queue-6.6/series b/queue-6.6/series
index e09c4591aa5a8e5e8e7e16dd85c2340ba3fee674..968111364e10b99f27277392a7775ef50a156c5f 100644 (file)
--- a/queue-6.6/series
+++ b/queue-6.6/series
@@ -167,3 +167,5 @@ net-ipv4-bound-tcp-reordering-sysctl-writes-and-mtu-probe-sizes.patch
 mfd-cros_ec-delay-dev_set_drvdata-until-probe-success.patch
 mm-shrinker-fix-null-pointer-dereference-in-debugfs.patch
 netfilter-ctnetlink-use-nf_ct_exp_net-in-expectation-dump.patch
+netfilter-ebtables-module-names-must-be-null-terminated.patch
+netfilter-ebtables-terminate-table-name-before-find_table_lock.patch