[PATCH] netfilter: ip_tables: propagate compat_table_info() error

[PATCH] netfilter: ip_tables: propagate compat_table_info() error

[Noah Weinberger]

Hello,

In the IPT_SO_GET_INFO compat path, the return value of
compat_table_info() is ignored: on failure (vmalloc ENOMEM in
xt_compat_init_offsets()), private = &tmp is used anyway, and ret is
overwritten with 0 after a successful copy_to_user - so a 32-bit caller
gets stale or partially adjusted 64-bit-layout size/hook_entry/underflow
values instead of an error. The follow-up GET_ENTRIES then fails with
-EAGAIN. tmp is fully initialized, so there is no disclosure; this is a
robustness fix. The same pattern exists in ip6_tables.c; both are
patched.

Affected version/commit: mainline fa4ad798f6f681031775266044ba1b0cf3c670bd (v7.4-rc1, 2026-11-07), net/ipv4/netfilter/ip_tables.c:968-987, net/ipv6/netfilter/ip6_tables.c:989-1008.
Longstanding code.

This was found during an assisted (AI-supported) static source review of
mainline fa4ad798f6f681031775266044ba1b0cf3c670bd (v7.4-rc1, 2026-11-07); every code path cited below was re-verified by the
reporter against that tree. The patch below has NOT been compiled and has
NOT been runtime tested, and no reproducer was produced - the triggering
conditions are described above instead. Please treat this as a report for
verification rather than a battle-tested fix.

Reported-by: Noah Weinberger <noahweinberger2003@proton.me>
---
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 809441c..e11a5af 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -968,6 +968,8 @@ static int get_info(struct net *net, void __user *user, const int *len)
 		if (in_compat_syscall()) {
 			ret = compat_table_info(private, &tmp);
 			xt_compat_flush_offsets(AF_INET);
+			if (ret)
+				goto unlock;
 			private = &tmp;
 		}
 #endif
@@ -986,6 +988,7 @@ static int get_info(struct net *net, void __user *user, const int *len)
 		else
 			ret = 0;
 
+unlock:
 		xt_table_unlock(t);
 		module_put(t->me);
 	} else

diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 313c4aa..1d5749e 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -989,6 +989,8 @@ static int get_info(struct net *net, void __user *user, const int *len)
 		if (in_compat_syscall()) {
 			ret = compat_table_info(private, &tmp);
 			xt_compat_flush_offsets(AF_INET6);
+			if (ret)
+				goto unlock;
 			private = &tmp;
 		}
 #endif
@@ -1007,6 +1009,7 @@ static int get_info(struct net *net, void __user *user, const int *len)
 		else
 			ret = 0;
 
+unlock:
 		xt_table_unlock(t);
 		module_put(t->me);
 	} else

Re: [PATCH] netfilter: ip_tables: propagate compat_table_info() error

[Florian Westphal]

Noah Weinberger <NoahWeinberger2003@proton.me> wrote:
> In the IPT_SO_GET_INFO compat path, the return value of
> compat_table_info() is ignored: on failure (vmalloc ENOMEM in
> xt_compat_init_offsets()), private = &tmp is used anyway, and ret is
> overwritten with 0 after a successful copy_to_user - so a 32-bit caller
> gets stale or partially adjusted 64-bit-layout size/hook_entry/underflow
> values instead of an error. The follow-up GET_ENTRIES then fails with
> -EAGAIN. tmp is fully initialized, so there is no disclosure; this is a
> robustness fix. The same pattern exists in ip6_tables.c; both are
> patched.
> 
> Affected version/commit: mainline fa4ad798f6f681031775266044ba1b0cf3c670bd (v7.4-rc1, 2026-11-07), net/ipv4/netfilter/ip_tables.c:968-987, net/ipv6/netfilter/ip6_tables.c:989-1008.
> Longstanding code.
> 
> This was found during an assisted (AI-supported) static source review of
> mainline fa4ad798f6f681031775266044ba1b0cf3c670bd (v7.4-rc1, 2026-11-07); every code path cited below was re-verified by the
> reporter against that tree. The patch below has NOT been compiled and has
> NOT been runtime tested, and no reproducer was produced - the triggering
> conditions are described above instead. Please treat this as a report for
> verification rather than a battle-tested fix.

8-(

net/ipv4/netfilter/ip_tables.c: In function 'get_info':
net/ipv4/netfilter/ip_tables.c:992:1: error: label 'unlock' defined but not used [-Werror=unused-label]
  992 | unlock:

8-(