[PATCH] netfilter: xt_hashlimit: fix uninitialized rateinfo.burst read on shared table

When two xt_hashlimit rules share the same table name, htable_find_get()
matches on name+family only, ignoring mode/revision. If Rule A creates
the table without XT_HASHLIMIT_RATE_MATCH in its mode, rateinfo_init()
takes the default branch and only initializes rateinfo.credit,
rateinfo.credit_cap, and rateinfo.cost (union offsets 0-23).

The rateinfo union is 32 bytes; rateinfo.burst sits at union offset 24
and is never written by the default branch. Since dsthash_alloc_init()
uses kmem_cache_alloc() without zeroing, burst contains stale slab data.

If Rule B shares the same table but has XT_HASHLIMIT_RATE_MATCH set in
its own cfg->mode, hashlimit_mt_common() reads dh->rateinfo.burst, which
is uninitialized.

Fix by zeroing the rateinfo union immediately after allocation.

Signed-off-by: Talha Berk Arslan <[email protected]>
---
 net/netfilter/xt_hashlimit.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index 2704b4b60..8943ed608 100644
--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c
@@ -244,6 +244,7 @@ dsthash_alloc_init(struct xt_hashlimit_htable *ht,
 	} else
 		ent = kmem_cache_alloc(hashlimit_cachep, GFP_ATOMIC);
 	if (ent) {
+		memset(&ent->rateinfo, 0, sizeof(ent->rateinfo));
 		memcpy(&ent->dst, dst, sizeof(ent->dst));
 		spin_lock_init(&ent->lock);
 
-- 
2.54.0.windows.1