Eric Dumazet bdd39576bf net: bridge: prevent too big nested attributes in br_fill_linkxstats() ...

After commit ff205bf8c5 ("netlink: add one debug check in nla_nest_end()")
syzbot found that br_fill_linkxstats() can send corrupted netlink packets.

Make sure the nested attribute size is bounded.

Fixes: a60c090361 ("bridge: netlink: export per-vlan stats")
Reported-by: [email protected]
Closes: https://lore.kernel.org/netdev/[email protected]/
Signed-off-by: Eric Dumazet <[email protected]>
Reviewed-by: Ido Schimmel <[email protected]>
Acked-by: Nikolay Aleksandrov <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Jakub Kicinski <[email protected]>

2026-05-21 08:47:36 -07:00

..

netfilter

netfilter: bridge: eb_tables: close module init race

2026-05-08 01:30:17 +02:00

br_arp_nd_proxy.c

net: bridge: use a stable FDB dst snapshot in RCU readers

2026-04-16 12:47:41 +02:00

br_cfm_netlink.c

…

br_cfm.c

bridge: cfm: Fix race condition in peer_mep deletion

2026-03-12 18:33:52 -07:00

br_device.c

net: bridge: add stp_mode attribute for STP mode selection

2026-04-10 15:52:24 -07:00

br_fdb.c

Merge tag 'net-deletions' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next

2026-04-24 09:41:58 -07:00

br_forward.c

…

br_if.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

br_input.c

net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled

2026-03-05 07:52:56 -08:00

br_ioctl.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

br_mdb.c

Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses

2026-02-22 08:26:33 -08:00

br_mrp_netlink.c

bridge: mrp: reject zero test interval to avoid OOM panic

2026-03-31 16:11:24 +02:00

br_mrp_switchdev.c

…

br_mrp.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

br_mst.c

…

br_multicast_eht.c

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21 01:02:28 -08:00

br_multicast.c

bridge: mcast: Fix a possible use-after-free when removing a bridge port

2026-05-19 18:15:22 -07:00

br_netfilter_hooks.c

netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge()

2026-05-16 13:22:50 +02:00

br_netfilter_ipv6.c

netfilter: remove nf_ipv6_ops and use direct function calls

2026-03-29 11:21:24 -07:00

br_netlink_tunnel.c

…

br_netlink.c

net: bridge: prevent too big nested attributes in br_fill_linkxstats()

2026-05-21 08:47:36 -07:00

br_nf_core.c

…

br_private_cfm.h

…

br_private_mcast_eht.h

…

br_private_mrp.h

…

br_private_stp.h

…

br_private_tunnel.h

…

br_private.h

net: remove unused ATM protocols and legacy ATM device drivers

2026-04-23 12:21:14 -07:00

br_stp_bpdu.c

…

br_stp_if.c

net: bridge: add stp_mode attribute for STP mode selection

2026-04-10 15:52:24 -07:00

br_stp_timer.c

…

br_stp.c

…

br_switchdev.c

bridge: No DEV_PATH_BR_VLAN_UNTAG_HW for dsa foreign

2026-03-19 13:14:00 +01:00

br_sysfs_br.c

Merge tag 'mm-nonmm-stable-2026-02-12-10-48' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2026-02-12 12:13:01 -08:00

br_sysfs_if.c

net: bridge: use sysfs_emit instead of sprintf

2026-02-03 19:19:42 -08:00

br_vlan_options.c

bridge: Check relevant per-VLAN options in VLAN range grouping

2026-02-26 19:24:29 -08:00

br_vlan_tunnel.c

bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress

2026-01-04 09:45:35 -08:00

br_vlan.c

bridge: No DEV_PATH_BR_VLAN_UNTAG_HW for dsa foreign

2026-03-19 13:14:00 +01:00

br.c

net: remove unused ATM protocols and legacy ATM device drivers

2026-04-23 12:21:14 -07:00

Kconfig

ipv6: convert CONFIG_IPV6 to built-in only and clean up Kconfigs

2026-03-29 11:21:22 -07:00

Makefile

…