android_kernel_motorola_sm6375/net
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Florian Westphal 66d41268ed netfilter: xt_nfacct: don't assume acct name is null-terminated
[ Upstream commit bf58e667af7d96c8eb9411f926a0a0955f41ce21 ]

BUG: KASAN: slab-out-of-bounds in .. lib/vsprintf.c:721
Read of size 1 at addr ffff88801eac95c8 by task syz-executor183/5851
[..]
 string+0x231/0x2b0 lib/vsprintf.c:721
 vsnprintf+0x739/0xf00 lib/vsprintf.c:2874
 [..]
 nfacct_mt_checkentry+0xd2/0xe0 net/netfilter/xt_nfacct.c:41
 xt_check_match+0x3d1/0xab0 net/netfilter/x_tables.c:523

nfnl_acct_find_get() handles non-null input, but the error
printk relied on its presence.

Reported-by: syzbot+4ff165b9251e4d295690@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=4ff165b9251e4d295690
Tested-by: syzbot+4ff165b9251e4d295690@syzkaller.appspotmail.com
Fixes: ceb98d03ea ("netfilter: xtables: add nfacct match to support extended accounting")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-08-28 16:21:20 +02:00
..
6lowpan
9p
802
8021q net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime 2025-08-28 16:21:16 +02:00
appletalk net: appletalk: Fix use-after-free in AARP proxy probe 2025-08-28 16:21:17 +02:00
atm atm: clip: Fix NULL pointer dereference in vcc_sendmsg() 2025-07-17 18:25:02 +02:00
ax25
batman-adv batman-adv: Ignore own maximum aggregation size during RX 2025-04-10 14:29:38 +02:00
bluetooth Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU 2025-08-28 16:21:16 +02:00
bpf
bpfilter bpfilter: match bit size of bpfilter_umh to that of the kernel 2025-07-17 18:24:51 +02:00
bridge netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it 2025-06-27 11:02:46 +01:00
caif caif: reduce stack size, again 2025-08-28 16:21:19 +02:00
can can: bcm: add missing rcu read protection for procfs content 2025-06-04 14:32:35 +02:00
ceph
core sock: Correct error checking condition for (assign|release)_proto_idx() 2025-06-27 11:02:55 +01:00
dcb
dccp
decnet
dns_resolver
dsa
ethernet
hsr
ieee802154
ife
ipv4 tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range 2025-08-28 16:21:19 +02:00
ipv6 net: ipv6: Discard next-hop MTU less than minimum link MTU 2025-07-17 18:25:06 +02:00
iucv
kcm
key
l2tp
l3mdev
lapb
llc llc: fix data loss when reading from a socket in llc_ui_recvmsg() 2025-06-04 14:32:35 +02:00
mac80211 Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" 2025-08-28 16:21:20 +02:00
mac802154
mpls mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). 2025-06-27 11:02:57 +01:00
ncsi net: ncsi: Fix GCPS 64-bit member variables 2025-06-27 11:02:46 +01:00
netfilter netfilter: xt_nfacct: don't assume acct name is null-terminated 2025-08-28 16:21:20 +02:00
netlabel calipso: unlock rcu before returning -EAFNOSUPPORT 2025-06-27 11:02:50 +01:00
netlink netlink: Fix rmem check in netlink_broadcast_deliver(). 2025-07-17 18:25:03 +02:00
netrom
nfc NFC: nci: uart: Set tty->disc_data only in success path 2025-06-27 11:02:51 +01:00
nsh
openvswitch openvswitch: Fix unsafe attribute parsing in output_userspace() 2025-06-04 14:32:29 +02:00
packet af_packet: fix soft lockup issue caused by tpacket_snd() 2025-08-28 16:21:14 +02:00
phonet phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() 2025-08-28 16:21:14 +02:00
psample
qrtr
rds
rfkill
rose rose: fix dangling neighbour pointers in rose_rt_device_down() 2025-07-17 18:25:00 +02:00
rxrpc rxrpc: Fix oops due to non-existence of prealloc backlog struct 2025-07-17 18:25:02 +02:00
sched net/sched: Restrict conditions for adding duplicating netems to qdisc tree 2025-08-28 16:21:19 +02:00
sctp sctp: Do not wake readers in __sctp_write_space() 2025-06-27 11:02:54 +01:00
smc
strparser
sunrpc xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create 2025-06-27 11:02:58 +01:00
switchdev
tipc tipc: Fix use-after-free in tipc_conn_close(). 2025-07-17 18:25:01 +02:00
tls bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls 2025-08-28 16:21:19 +02:00
unix
vmw_vsock vsock/vmci: Clear the vmci transport packet properly when initializing it 2025-07-17 18:24:55 +02:00
wimax
wireless
x25
xdp
xfrm xfrm: Sanitize marks before insert 2025-06-04 14:32:35 +02:00
compat.c
Kconfig
Makefile
socket.c
sysctl_net.c