Re: [PATCH nf 1/1] netfilter: xt_IDLETIMER: validate label before debug logging in checkentry

On 8/18/26 3:56 AM, Ren Wei wrote:
> From: Luxiao Xu <[email protected]>
> 
> Both idletimer_tg_checkentry() and idletimer_tg_checkentry_v1() invoke
> pr_debug() with "%s" on info->label before idletimer_tg_helper() verifies
> that the 28-byte label is properly NUL-terminated.
> 
> If a user-supplied label is not NUL-terminated, printk format string
> parsing reads past the end of the allocated target structure until it
> encounters a zero byte. In builds with DEBUG enabled or when dynamic debug
> is active for this callsite, this triggers a slab-out-of-bounds read
> (detected by KASAN) and can disclose adjacent kernel memory into the logs.
> 
> Fix this by moving the pr_debug() calls after idletimer_tg_helper() has
> successfully validated the label string.
> 
> Fixes: 0902b469bd25 ("netfilter: xtables: idletimer target implementation")
> Fixes: 68983a354a65 ("netfilter: xtables: Add snapshot of hardidletimer target")
> Cc: [email protected]
> Reported-by: Vega <[email protected]>
> Assisted-by: Codex:gpt-5.4
> Signed-off-by: Luxiao Xu <[email protected]>
> Signed-off-by: Ren Wei <[email protected]>
> ---

Reviewed-by: Fernando Fernandez Mancera <[email protected]>

Thanks!