diff options
| author | Florian Westphal <fw@strlen.de> | 2026-07-04 10:23:31 +0200 |
|---|---|---|
| committer | Florian Westphal <fw@strlen.de> | 2026-07-08 15:22:03 +0200 |
| commit | cbfe53599eebffd188938ab6774cc41794f6f9d5 (patch) | |
| tree | 1f4b8f3420ee8f703a2d8420599a26ad5663624d /include/linux | |
| parent | a622d2e9608c9dff47fc2e5759ac7aa3a836b45d (diff) | |
netfilter: ebtables: zero chainstack array
sashiko reports:
looking at ebtables table
translation, could a sparse cpu_possible_mask lead to an uninitialized pointer
free?
If cpu_possible_mask is sparse (for example, CPU 0 and CPU 2 are possible,
but CPU 1 is not), the allocation loop skips CPU 1. If vmalloc_node() fails at
CPU 2, the cleanup loop will blindly decrement and call vfree() on
newinfo->chainstack[1].
Not a real-world bug, such allocation isn't expected to fail
in the first place.
Cc: stable@vger.kernel.org
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Florian Westphal <fw@strlen.de>
Diffstat (limited to 'include/linux')
0 files changed, 0 insertions, 0 deletions
