Florian Westphal 9e6c5169db netfilter: ebtables: zero chainstack array ...

[ Upstream commit cbfe53599e ]

sashiko reports:
 looking at ebtables table
 translation, could a sparse cpu_possible_mask lead to an uninitialized pointer
 free?

 If cpu_possible_mask is sparse (for example, CPU 0 and CPU 2 are possible,
 but CPU 1 is not), the allocation loop skips CPU 1. If vmalloc_node() fails at
 CPU 2, the cleanup loop will blindly decrement and call vfree() on
 newinfo->chainstack[1].

Not a real-world bug, such allocation isn't expected to fail
in the first place.

Cc: stable@vger.kernel.org
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2026-07-24 16:03:49 +02:00

..

netfilter

netfilter: ebtables: zero chainstack array

2026-07-24 16:03:49 +02:00

br_arp_nd_proxy.c

…

br_cfm_netlink.c

…

br_cfm.c

…

br_device.c

…

br_fdb.c

…

br_forward.c

…

br_if.c

…

br_input.c

…

br_ioctl.c

…

br_mdb.c

…

br_mrp_netlink.c

…

br_mrp_switchdev.c

…

br_mrp.c

…

br_mst.c

…

br_multicast_eht.c

…

br_multicast.c

…

br_netfilter_hooks.c

…

br_netfilter_ipv6.c

…

br_netlink_tunnel.c

…

br_netlink.c

…

br_nf_core.c

…

br_private_cfm.h

…

br_private_mcast_eht.h

…

br_private_mrp.h

…

br_private_stp.h

…

br_private_tunnel.h

…

br_private.h

…

br_stp_bpdu.c

…

br_stp_if.c

…

br_stp_timer.c

…

br_stp.c

…

br_switchdev.c

…

br_sysfs_br.c

…

br_sysfs_if.c

…

br_vlan_options.c

…

br_vlan_tunnel.c

…

br_vlan.c

…

br.c

…

Kconfig

…

Makefile

…