Florian WestphalandGreg Kroah-Hartman fc7f105451 netfilter: ebtables: zero chainstack array ...

[ Upstream commit cbfe53599e ]

sashiko reports:
 looking at ebtables table
 translation, could a sparse cpu_possible_mask lead to an uninitialized pointer
 free?

 If cpu_possible_mask is sparse (for example, CPU 0 and CPU 2 are possible,
 but CPU 1 is not), the allocation loop skips CPU 1. If vmalloc_node() fails at
 CPU 2, the cleanup loop will blindly decrement and call vfree() on
 newinfo->chainstack[1].

Not a real-world bug, such allocation isn't expected to fail
in the first place.

Cc: stable@vger.kernel.org
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2026-07-24 15:55:14 +02:00

..

netfilter

netfilter: ebtables: zero chainstack array

2026-07-24 15:55:14 +02:00

br_arp_nd_proxy.c

net: bridge: use a stable FDB dst snapshot in RCU readers

2026-06-19 13:37:20 +02:00

br_cfm_netlink.c

bridge: cfm: reject invalid CCM interval at configuration time

2026-07-24 15:54:42 +02:00

br_cfm.c

bridge: cfm: reject invalid CCM interval at configuration time

2026-07-24 15:54:42 +02:00

br_device.c

net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled

2026-03-25 11:03:02 +01:00

br_fdb.c

net: bridge: use a stable FDB dst snapshot in RCU readers

2026-06-19 13:37:20 +02:00

br_forward.c

net: bridge: fix use-after-free due to MST port state bypass

2025-12-07 06:12:30 +09:00

br_if.c

bridge: stp: Fix a potential use-after-free when deleting a bridge

2026-07-24 15:54:54 +02:00

br_input.c

net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled

2026-03-25 11:03:02 +01:00

br_ioctl.c

net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF.

2026-01-11 15:19:23 +01:00

br_mdb.c

…

br_mrp_netlink.c

…

br_mrp_switchdev.c

…

br_mrp.c

…

br_mst.c

net: bridge: fix MST static key usage

2025-12-07 06:12:30 +09:00

br_multicast_eht.c

…

br_multicast.c

bridge: mcast: Fix a possible use-after-free when removing a bridge port

2026-06-01 17:39:42 +02:00

br_netfilter_hooks.c

netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm

2025-09-09 18:54:13 +02:00

br_netfilter_ipv6.c

…

br_netlink_tunnel.c

…

br_netlink.c

…

br_nf_core.c

…

br_private_cfm.h

…

br_private_mcast_eht.h

…

br_private_mrp.h

…

br_private_stp.h

…

br_private_tunnel.h

…

br_private.h

net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF.

2026-01-11 15:19:23 +01:00

br_stp_bpdu.c

…

br_stp_if.c

…

br_stp_timer.c

…

br_stp.c

bridge: stp: Fix a potential use-after-free when deleting a bridge

2026-07-24 15:54:54 +02:00

br_switchdev.c

…

br_sysfs_br.c

…

br_sysfs_if.c

…

br_vlan_options.c

…

br_vlan_tunnel.c

bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress

2026-01-17 16:39:30 +01:00

br_vlan.c

bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu()

2025-10-19 16:23:09 +02:00

br.c

net: bridge: Install FDB for bridge MAC on VLAN 0

2025-12-07 06:12:26 +09:00

Kconfig

…

Makefile

…