[PATCH nf 1/1] netfilter: xt_IDLETIMER: validate label before debug logging in checkentry

From: Luxiao Xu <[email protected]>

Both idletimer_tg_checkentry() and idletimer_tg_checkentry_v1() invoke
pr_debug() with "%s" on info->label before idletimer_tg_helper() verifies
that the 28-byte label is properly NUL-terminated.

If a user-supplied label is not NUL-terminated, printk format string
parsing reads past the end of the allocated target structure until it
encounters a zero byte. In builds with DEBUG enabled or when dynamic debug
is active for this callsite, this triggers a slab-out-of-bounds read
(detected by KASAN) and can disclose adjacent kernel memory into the logs.

Fix this by moving the pr_debug() calls after idletimer_tg_helper() has
successfully validated the label string.

Fixes: 0902b469bd25 ("netfilter: xtables: idletimer target implementation")
Fixes: 68983a354a65 ("netfilter: xtables: Add snapshot of hardidletimer target")
Cc: [email protected]
Reported-by: Vega <[email protected]>
Assisted-by: Codex:gpt-5.4
Signed-off-by: Luxiao Xu <[email protected]>
Signed-off-by: Ren Wei <[email protected]>
---
 net/netfilter/xt_IDLETIMER.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/net/netfilter/xt_IDLETIMER.c b/net/netfilter/xt_IDLETIMER.c
index bfcf2d44e93d..8f7b1ece0136 100644
--- a/net/netfilter/xt_IDLETIMER.c
+++ b/net/netfilter/xt_IDLETIMER.c
@@ -318,14 +318,15 @@ static int idletimer_tg_checkentry(const struct xt_tgchk_param *par)
 	struct idletimer_tg_info *info = par->targinfo;
 	int ret;
 
-	pr_debug("checkentry targinfo%s\n", info->label);
-
 	ret = idletimer_tg_helper(info);
 	if(ret < 0)
 	{
 		pr_debug("checkentry helper return invalid\n");
 		return -EINVAL;
 	}
+
+	pr_debug("checkentry targinfo%s\n", info->label);
+
 	mutex_lock(&list_mutex);
 
 	info->timer = __idletimer_tg_find_by_label(info->label);
@@ -360,8 +361,6 @@ static int idletimer_tg_checkentry_v1(const struct xt_tgchk_param *par)
 	struct idletimer_tg_info_v1 *info = par->targinfo;
 	int ret;
 
-	pr_debug("checkentry targinfo%s\n", info->label);
-
 	if (info->send_nl_msg)
 		return -EOPNOTSUPP;
 
@@ -372,6 +371,8 @@ static int idletimer_tg_checkentry_v1(const struct xt_tgchk_param *par)
 		return -EINVAL;
 	}
 
+	pr_debug("checkentry targinfo%s\n", info->label);
+
 	if (info->timer_type > XT_IDLETIMER_ALARM) {
 		pr_debug("invalid value for timer type\n");
 		return -EINVAL;
-- 
2.43.0