From: Greg Kroah-Hartman Date: Mon, 13 Jul 2026 13:56:11 +0000 (+0200) Subject: 5.15-stable patches X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=1ca57e1cefe8e52b637f75df7417ebd1fa9bfc7a;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: netfilter-ebtables-module-names-must-be-null-terminated.patch netfilter-ebtables-terminate-table-name-before-find_table_lock.patch --- diff --git a/queue-5.15/netfilter-ebtables-module-names-must-be-null-terminated.patch b/queue-5.15/netfilter-ebtables-module-names-must-be-null-terminated.patch new file mode 100644 index 0000000000..f1d60535b8 --- /dev/null +++ b/queue-5.15/netfilter-ebtables-module-names-must-be-null-terminated.patch @@ -0,0 +1,32 @@ +From 084d23f818321390509e9738a0b08bbf46df6425 Mon Sep 17 00:00:00 2001 +From: Florian Westphal +Date: Sat, 4 Jul 2026 12:05:15 +0200 +Subject: netfilter: ebtables: module names must be null-terminated + +From: Florian Westphal + +commit 084d23f818321390509e9738a0b08bbf46df6425 upstream. + +We need to explicitly check the length, else we may pass non-null +terminated string to request_module(). + +Cc: stable@vger.kernel.org +Fixes: bcf493428840 ("netfilter: ebtables: Fix extension lookup with identical name") +Signed-off-by: Florian Westphal +Signed-off-by: Greg Kroah-Hartman +--- + net/bridge/netfilter/ebtables.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/bridge/netfilter/ebtables.c ++++ b/net/bridge/netfilter/ebtables.c +@@ -402,6 +402,9 @@ ebt_check_match(struct ebt_entry_match * + left - sizeof(struct ebt_entry_match) < m->match_size) + return -EINVAL; + ++ if (strnlen(m->u.name, XT_EXTENSION_MAXNAMELEN) == XT_EXTENSION_MAXNAMELEN) ++ return -EINVAL; ++ + match = xt_find_match(NFPROTO_BRIDGE, m->u.name, m->u.revision); + if (IS_ERR(match) || match->family != NFPROTO_BRIDGE) { + if (!IS_ERR(match)) diff --git a/queue-5.15/netfilter-ebtables-terminate-table-name-before-find_table_lock.patch b/queue-5.15/netfilter-ebtables-terminate-table-name-before-find_table_lock.patch new file mode 100644 index 0000000000..640ae3de1e --- /dev/null +++ b/queue-5.15/netfilter-ebtables-terminate-table-name-before-find_table_lock.patch @@ -0,0 +1,77 @@ +From a622d2e9608c9dff47fc2e5759ac7aa3a836b45d Mon Sep 17 00:00:00 2001 +From: Xiang Mei +Date: Sun, 5 Jul 2026 14:58:00 -0700 +Subject: netfilter: ebtables: terminate table name before find_table_lock() + +From: Xiang Mei + +commit a622d2e9608c9dff47fc2e5759ac7aa3a836b45d upstream. + +update_counters() and compat_update_counters() forward a user-supplied +32-byte table name to find_table_lock() without NUL-terminating it. On a +lookup miss, find_inlist_lock() calls try_then_request_module(..., "%s%s", +"ebtable_", name), and vsnprintf() reads past the name field and the +stack object until it hits a zero byte. + + BUG: KASAN: stack-out-of-bounds in string (lib/vsprintf.c:648 lib/vsprintf.c:730) + Read of size 1 at addr ffff8880119dfb20 by task exploit/147 + Call Trace: + ... + string (lib/vsprintf.c:648 lib/vsprintf.c:730) + vsnprintf (lib/vsprintf.c:2945) + __request_module (kernel/module/kmod.c:150) + do_update_counters.isra.0 (net/bridge/netfilter/ebtables.c:371 net/bridge/netfilter/ebtables.c:380) + update_counters (net/bridge/netfilter/ebtables.c:1440) + do_ebt_set_ctl (net/bridge/netfilter/ebtables.c:2573) + nf_setsockopt (net/netfilter/nf_sockopt.c:101) + ip_setsockopt (net/ipv4/ip_sockglue.c:1424) + raw_setsockopt (net/ipv4/raw.c:847) + __sys_setsockopt (net/socket.c:2393) + ... + +compat_do_replace() shares the same unterminated name via +compat_copy_ebt_replace_from_user(); terminate it there too so all +find_table_lock() callers behave alike. The other callers already +terminate the name after the copy. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Fixes: 81e675c227ec ("netfilter: ebtables: add CONFIG_COMPAT support") +Cc: stable@vger.kernel.org +Reported-by: Weiming Shi +Assisted-by: Claude:claude-opus-4-8 +Signed-off-by: Xiang Mei +Signed-off-by: Florian Westphal +Signed-off-by: Greg Kroah-Hartman +--- + net/bridge/netfilter/ebtables.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/net/bridge/netfilter/ebtables.c ++++ b/net/bridge/netfilter/ebtables.c +@@ -1432,6 +1432,8 @@ static int update_counters(struct net *n + if (copy_from_sockptr(&hlp, arg, sizeof(hlp))) + return -EFAULT; + ++ hlp.name[sizeof(hlp.name) - 1] = '\0'; ++ + if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter)) + return -EINVAL; + +@@ -2271,6 +2273,8 @@ static int compat_copy_ebt_replace_from_ + + memcpy(repl, &tmp, offsetof(struct ebt_replace, hook_entry)); + ++ repl->name[sizeof(repl->name) - 1] = '\0'; ++ + /* starting with hook_entry, 32 vs. 64 bit structures are different */ + for (i = 0; i < NF_BR_NUMHOOKS; i++) + repl->hook_entry[i] = compat_ptr(tmp.hook_entry[i]); +@@ -2393,6 +2397,8 @@ static int compat_update_counters(struct + if (copy_from_sockptr(&hlp, arg, sizeof(hlp))) + return -EFAULT; + ++ hlp.name[sizeof(hlp.name) - 1] = '\0'; ++ + /* try real handler in case userland supplied needed padding */ + if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter)) + return update_counters(net, arg, len); diff --git a/queue-5.15/series b/queue-5.15/series index bfc2a6347d..a49e423498 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -108,3 +108,5 @@ io_uring-io-wq-re-check-io_wq_bit_exit-for-each-linked-work-item.patch ipv4-igmp-remove-multicast-group-from-hash-table-on-device-destruction.patch net-ipv4-bound-tcp-reordering-sysctl-writes-and-mtu-probe-sizes.patch mfd-cros_ec-delay-dev_set_drvdata-until-probe-success.patch +netfilter-ebtables-module-names-must-be-null-terminated.patch +netfilter-ebtables-terminate-table-name-before-find_table_lock.patch