Eric Dumazet bdd39576bf net: bridge: prevent too big nested attributes in br_fill_linkxstats() ...

After commit ff205bf8c554 ("netlink: add one debug check in nla_nest_end()")
syzbot found that br_fill_linkxstats() can send corrupted netlink packets.

Make sure the nested attribute size is bounded.

Fixes: a60c090361 ("bridge: netlink: export per-vlan stats")
Reported-by: syzbot+a35f9259d08f907c06e6@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/6a0b0da3.050a0220.175f0c.0000.GAE@google.com/
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
Link: https://patch.msgid.link/20260520114207.1394241-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

2026-05-21 08:47:36 -07:00

..

bpf_sk_storage.c

bpf: Fix sk_local_storage diag dumping uninitialized special fields

2026-04-24 11:21:34 -07:00

datagram.c

net: datagram: introduce datagram_poll_queue for custom receive queues

2025-10-23 15:46:04 +02:00

dev_addr_lists_test.c

net: cache snapshot entries for ndo_set_rx_mode_async

2026-04-21 12:50:13 +02:00

dev_addr_lists.c

net: warn ops-locked drivers still using ndo_set_rx_mode

2026-04-21 12:50:25 +02:00

dev_api.c

net: introduce ndo_set_rx_mode_async and netdev_rx_mode_work

2026-04-21 12:50:03 +02:00

dev_ioctl.c

net: introduce ndo_set_rx_mode_async and netdev_rx_mode_work

2026-04-21 12:50:03 +02:00

dev.c

net: napi: Avoid gro timer misfiring at end of busypoll

2026-05-08 15:02:32 -07:00

dev.h

net: introduce ndo_set_rx_mode_async and netdev_rx_mode_work

2026-04-21 12:50:03 +02:00

devmem.c

net: devmem: reject dma-buf bind with non-page-aligned size or SG length

2026-05-20 18:59:01 -07:00

devmem.h

net: inline net_is_devmem_iov()

2026-01-25 13:18:53 -08:00

drop_monitor.c

Convert more 'alloc_obj' cases to default GFP_KERNEL arguments

2026-02-21 20:03:00 -08:00

dst_cache.c

net: dst: annotate data-races around dst->obsolete

2025-07-02 14:32:29 -07:00

dst.c

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21 01:02:28 -08:00

failover.c

net: net_failover: Fix the deadlock in slave register

2026-05-13 19:01:03 -07:00

fib_notifier.c

net: Add SPDX ids to some source files

2026-03-09 18:32:45 -07:00

fib_rules.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2025-04-17 12:26:50 -07:00

filter.c

Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

2026-05-09 18:42:54 -07:00

flow_dissector.c

flow_dissector: do not dissect PPPoE PFC frames

2026-04-20 11:35:16 -07:00

flow_offload.c

Convert more 'alloc_obj' cases to default GFP_KERNEL arguments

2026-02-21 20:03:00 -08:00

gen_estimator.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

gen_stats.c

net: Remove the obsolte u64_stats_fetch_*_irq() users (net).

2022-10-28 20:13:54 -07:00

gro_cells.c

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21 01:02:28 -08:00

gro.c

net: gro: don't merge zcopy skbs

2026-05-21 08:21:33 -07:00

gso.c

net: introduce struct net_hotdata

2024-03-07 21:12:41 -08:00

hotdata.c

net: remove EXPORT_IPV6_MOD() and EXPORT_IPV6_MOD_GPL() macros

2026-03-29 11:21:22 -07:00

hwbm.c

…

ieee8021q_helpers.c

net: ieee8021q: fix insufficient table-size assertion

2025-07-01 12:55:49 +02:00

link_watch.c

net/sched: do not reset queues in graft operations

2026-03-09 18:55:55 -07:00

lock_debug.c

netdev: fix the locking for netdev notifications

2025-04-17 18:55:14 -07:00

lwt_bpf.c

bpf: remove ipv6_bpf_stub completely and use direct function calls

2026-03-29 11:21:24 -07:00

lwtunnel.c

inet: Remove rtnl_is_held arg of lwtunnel_valid_encap_type(_attr)?().

2025-05-20 19:18:24 -07:00

Makefile

net: get rid of net/core/request_sock.c

2026-02-05 09:23:05 -08:00

mp_dmabuf_devmem.h

memory-provider: dmabuf devmem memory provider

2024-09-11 20:44:31 -07:00

neighbour.c

neigh: let neigh_xmit take skb ownership

2026-04-27 19:02:11 -07:00

net_namespace.c

Merge tag 'net-next-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next

2026-04-14 18:36:10 -07:00

net_test.c

pfcp: always set pfcp metadata

2024-04-01 10:49:28 +01:00

net-procfs.c

net: add proper RCU protection to /proc/net/ptype

2026-02-03 19:20:30 -08:00

net-sysfs.c

Merge tag 'net-next-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next

2026-04-14 18:36:10 -07:00

net-sysfs.h

net: add skb_defer_disable_key static key

2026-03-12 19:25:33 -07:00

net-traces.c

move asm/unaligned.h to linux/unaligned.h

2024-10-02 17:23:23 -04:00

netclassid_cgroup.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

netdev_config.c

net: add queue config validation callback

2026-01-23 11:49:02 -08:00

netdev_queues.c

net: remove the netif_get_rx_queue_lease_locked() helpers

2026-04-09 18:26:28 -07:00

netdev_rx_queue.c

net: Rename ifq_idx to rxq_idx in netif_mp_* helpers

2026-04-12 09:12:07 -07:00

netdev-genl-gen.c

net: Add queue-create operation

2026-04-09 18:21:45 -07:00

netdev-genl-gen.h

net: Add queue-create operation

2026-04-09 18:21:45 -07:00

netdev-genl.c

net: remove the netif_get_rx_queue_lease_locked() helpers

2026-04-09 18:26:28 -07:00

netevent.c

net: core: Correct function name netevent_unregister_notifier() in the kerneldoc

2021-03-28 17:56:56 -07:00

netmem_priv.h

mm: introduce a new page type for page pool in page type

2026-04-05 13:53:19 -07:00

netpoll.c

netpoll: normalize skb->dev to the netpoll device

2026-05-21 08:10:18 -07:00

netprio_cgroup.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

of_net.c

net: Explicitly include correct DT includes

2023-07-27 20:33:16 -07:00

page_pool_priv.h

net: page_pool: don't try to stash the napi id

2025-01-27 14:37:41 -08:00

page_pool_user.c

page_pool: store detach_time as ktime_t to avoid false-negatives

2026-03-10 19:03:34 -07:00

page_pool.c

page_pool: fix memory-provider leak in page_pool_create_percpu() error path

2026-04-29 19:11:49 -07:00

pktgen.c

kernel.h: drop hex.h and update all hex.h users

2026-01-20 19:44:19 -08:00

ptp_classifier.c

ptp: Add generic PTP is_sync() function

2022-03-07 11:31:34 +00:00

rtnetlink.c

net: bridge: prevent too big nested attributes in br_fill_linkxstats()

2026-05-21 08:47:36 -07:00

scm.c

net: use ktime_t in struct scm_timestamping_internal

2026-03-04 17:53:34 -08:00

secure_seq.c

tcp: secure_seq: add back ports to TS offset

2026-03-04 17:44:35 -08:00

selftests.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

skb_fault_injection.c

net: Implement fault injection forcing skb reallocation

2024-11-12 12:05:33 +01:00

skbuff.c

net: skbuff: propagate shared-frag marker through frag-transfer helpers

2026-05-21 11:31:05 +02:00

skmsg.c

bpf, skmsg: fix verdict sk_data_ready racing with ktls rx

2026-05-20 17:21:21 -07:00

sock_destructor.h

skb_expand_head() adjust skb->truesize incorrectly

2021-10-22 12:35:51 -07:00

sock_diag.c

net: Add SPDX ids to some source files

2026-03-09 18:32:45 -07:00

sock_map.c

sockmap: Fix sk_psock_drop() race vs sock_map_{unhash,close,destroy}().

2026-04-23 18:24:02 -07:00

sock_reuseport.c

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21 01:02:28 -08:00

sock.c

tcp: update window_clamp when SO_RCVBUF is set

2026-04-13 15:32:35 +02:00

stream.c

net: stream: add description for sk_stream_write_space()

2025-07-18 16:57:21 -07:00

sysctl_net_core.c

net: add skb_defer_disable_key static key

2026-03-12 19:25:33 -07:00

timestamping.c

net: Add the possibility to support a selected hwtstamp in netdevice

2024-12-16 12:51:40 +00:00

tso.c

net: tso: Introduce tso_dma_map and helpers

2026-04-12 10:54:31 -07:00

utils.c

kernel.h: drop hex.h and update all hex.h users

2026-01-20 19:44:19 -08:00

xdp.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00