Re: [PATCH net 14/14] netfilter: nf_tables: add hook transactions for device deletions

Paolo Abeni
2026-04-16T11:36:17Z

On 4/16/26 3:31 AM, Pablo Neira Ayuso wrote:
> @@ -10920,9 +11007,8 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)
> nf_tables_chain_notify(&ctx, NFT_MSG_DELCHAIN,
> &nft_trans_chain_hooks(trans));

AI notes that nf_tables_chain_notify() can now receive struct
nft_trans_hook arguments and it ends up calling nft_dump_basechain_hook
which expects nft_hook, possibly causing out-of-bounds slab read when
accessing hook->ifname.

It looks real to me. Possibly worthy strip this patch from the PR?

/P