• Florian Westphal's avatar
    netfilter: cttimeout: fix slab-out-of-bounds read typo in cttimeout_net_exit · 394e7716
    Florian Westphal authored
    syzbot reports:
      BUG: KASAN: slab-out-of-bounds in __list_del_entry_valid+0xcc/0xf0 lib/list_debug.c:42
      [..]
      list_del include/linux/list.h:148 [inline]
      cttimeout_net_exit+0x211/0x540 net/netfilter/nfnetlink_cttimeout.c:617
    
    Problem is the wrong name of the list member, so container_of() result is wrong.
    
    Reported-by: <syzbot+92968395eedbdbd3617d@syzkaller.appspotmail.com>
    Fixes: 78222bac ("netfilter: cttimeout: decouple unlink and free on netns destruction")
    Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
    394e7716
nfnetlink_cttimeout.c 16.4 KB