Re: [PATCH] netfilter: ip_tables: propagate compat_table_info() error

[Florian Westphal <fw@strlen.de>]

Noah Weinberger <NoahWeinberger2003@proton.me> wrote:
> In the IPT_SO_GET_INFO compat path, the return value of
> compat_table_info() is ignored: on failure (vmalloc ENOMEM in
> xt_compat_init_offsets()), private = &tmp is used anyway, and ret is
> overwritten with 0 after a successful copy_to_user - so a 32-bit caller
> gets stale or partially adjusted 64-bit-layout size/hook_entry/underflow
> values instead of an error. The follow-up GET_ENTRIES then fails with
> -EAGAIN. tmp is fully initialized, so there is no disclosure; this is a
> robustness fix. The same pattern exists in ip6_tables.c; both are
> patched.
> 
> Affected version/commit: mainline fa4ad798f6f681031775266044ba1b0cf3c670bd (v7.4-rc1, 2026-11-07), net/ipv4/netfilter/ip_tables.c:968-987, net/ipv6/netfilter/ip6_tables.c:989-1008.
> Longstanding code.
> 
> This was found during an assisted (AI-supported) static source review of
> mainline fa4ad798f6f681031775266044ba1b0cf3c670bd (v7.4-rc1, 2026-11-07); every code path cited below was re-verified by the
> reporter against that tree. The patch below has NOT been compiled and has
> NOT been runtime tested, and no reproducer was produced - the triggering
> conditions are described above instead. Please treat this as a report for
> verification rather than a battle-tested fix.

8-(

net/ipv4/netfilter/ip_tables.c: In function 'get_info':
net/ipv4/netfilter/ip_tables.c:992:1: error: label 'unlock' defined but not used [-Werror=unused-label]
  992 | unlock:

8-(