Eric Dumazet bdd39576bf net: bridge: prevent too big nested attributes in br_fill_linkxstats() ...

After commit ff205bf8c5 ("netlink: add one debug check in nla_nest_end()")
syzbot found that br_fill_linkxstats() can send corrupted netlink packets.

Make sure the nested attribute size is bounded.

Fixes: a60c090361 ("bridge: netlink: export per-vlan stats")
Reported-by: syzbot+a35f9259d08f907c06e6@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/6a0b0da3.050a0220.175f0c.0000.GAE@google.com/
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
Link: https://patch.msgid.link/20260520114207.1394241-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

2026-05-21 08:47:36 -07:00

..

bpf_sk_storage.c

bpf: Fix sk_local_storage diag dumping uninitialized special fields

2026-04-24 11:21:34 -07:00

datagram.c

…

dev_addr_lists_test.c

net: cache snapshot entries for ndo_set_rx_mode_async

2026-04-21 12:50:13 +02:00

dev_addr_lists.c

net: warn ops-locked drivers still using ndo_set_rx_mode

2026-04-21 12:50:25 +02:00

dev_api.c

net: introduce ndo_set_rx_mode_async and netdev_rx_mode_work

2026-04-21 12:50:03 +02:00

dev_ioctl.c

net: introduce ndo_set_rx_mode_async and netdev_rx_mode_work

2026-04-21 12:50:03 +02:00

dev.c

net: napi: Avoid gro timer misfiring at end of busypoll

2026-05-08 15:02:32 -07:00

dev.h

net: introduce ndo_set_rx_mode_async and netdev_rx_mode_work

2026-04-21 12:50:03 +02:00

devmem.c

net: devmem: reject dma-buf bind with non-page-aligned size or SG length

2026-05-20 18:59:01 -07:00

devmem.h

…

drop_monitor.c

Convert more 'alloc_obj' cases to default GFP_KERNEL arguments

2026-02-21 20:03:00 -08:00

dst_cache.c

…

dst.c

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21 01:02:28 -08:00

failover.c

net: net_failover: Fix the deadlock in slave register

2026-05-13 19:01:03 -07:00

fib_notifier.c

net: Add SPDX ids to some source files

2026-03-09 18:32:45 -07:00

fib_rules.c

…

filter.c

Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

2026-05-09 18:42:54 -07:00

flow_dissector.c

flow_dissector: do not dissect PPPoE PFC frames

2026-04-20 11:35:16 -07:00

flow_offload.c

Convert more 'alloc_obj' cases to default GFP_KERNEL arguments

2026-02-21 20:03:00 -08:00

gen_estimator.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

gen_stats.c

…

gro_cells.c

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21 01:02:28 -08:00

gro.c

net: gro: don't merge zcopy skbs

2026-05-21 08:21:33 -07:00

gso.c

…

hotdata.c

net: remove EXPORT_IPV6_MOD() and EXPORT_IPV6_MOD_GPL() macros

2026-03-29 11:21:22 -07:00

hwbm.c

…

ieee8021q_helpers.c

…

link_watch.c

net/sched: do not reset queues in graft operations

2026-03-09 18:55:55 -07:00

lock_debug.c

…

lwt_bpf.c

bpf: remove ipv6_bpf_stub completely and use direct function calls

2026-03-29 11:21:24 -07:00

lwtunnel.c

…

Makefile

net: get rid of net/core/request_sock.c

2026-02-05 09:23:05 -08:00

mp_dmabuf_devmem.h

…

neighbour.c

neigh: let neigh_xmit take skb ownership

2026-04-27 19:02:11 -07:00

net_namespace.c

Merge tag 'net-next-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next

2026-04-14 18:36:10 -07:00

net_test.c

…

net-procfs.c

…

net-sysfs.c

Merge tag 'net-next-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next

2026-04-14 18:36:10 -07:00

net-sysfs.h

net: add skb_defer_disable_key static key

2026-03-12 19:25:33 -07:00

net-traces.c

…

netclassid_cgroup.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

netdev_config.c

…

netdev_queues.c

net: remove the netif_get_rx_queue_lease_locked() helpers

2026-04-09 18:26:28 -07:00

netdev_rx_queue.c

net: Rename ifq_idx to rxq_idx in netif_mp_* helpers

2026-04-12 09:12:07 -07:00

netdev-genl-gen.c

net: Add queue-create operation

2026-04-09 18:21:45 -07:00

netdev-genl-gen.h

net: Add queue-create operation

2026-04-09 18:21:45 -07:00

netdev-genl.c

net: remove the netif_get_rx_queue_lease_locked() helpers

2026-04-09 18:26:28 -07:00

netevent.c

…

netmem_priv.h

mm: introduce a new page type for page pool in page type

2026-04-05 13:53:19 -07:00

netpoll.c

netpoll: normalize skb->dev to the netpoll device

2026-05-21 08:10:18 -07:00

netprio_cgroup.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

of_net.c

…

page_pool_priv.h

…

page_pool_user.c

page_pool: store detach_time as ktime_t to avoid false-negatives

2026-03-10 19:03:34 -07:00

page_pool.c

page_pool: fix memory-provider leak in page_pool_create_percpu() error path

2026-04-29 19:11:49 -07:00

pktgen.c

…

ptp_classifier.c

…

rtnetlink.c

net: bridge: prevent too big nested attributes in br_fill_linkxstats()

2026-05-21 08:47:36 -07:00

scm.c

net: use ktime_t in struct scm_timestamping_internal

2026-03-04 17:53:34 -08:00

secure_seq.c

tcp: secure_seq: add back ports to TS offset

2026-03-04 17:44:35 -08:00

selftests.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

skb_fault_injection.c

…

skbuff.c

net: skbuff: propagate shared-frag marker through frag-transfer helpers

2026-05-21 11:31:05 +02:00

skmsg.c

bpf, skmsg: fix verdict sk_data_ready racing with ktls rx

2026-05-20 17:21:21 -07:00

sock_destructor.h

…

sock_diag.c

net: Add SPDX ids to some source files

2026-03-09 18:32:45 -07:00

sock_map.c

sockmap: Fix sk_psock_drop() race vs sock_map_{unhash,close,destroy}().

2026-04-23 18:24:02 -07:00

sock_reuseport.c

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21 01:02:28 -08:00

sock.c

tcp: update window_clamp when SO_RCVBUF is set

2026-04-13 15:32:35 +02:00

stream.c

…

sysctl_net_core.c

net: add skb_defer_disable_key static key

2026-03-12 19:25:33 -07:00

timestamping.c

…

tso.c

net: tso: Introduce tso_dma_map and helpers

2026-04-12 10:54:31 -07:00

utils.c

…

xdp.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00