Re: [PATCH net] netfilter: nf_flow_table_offload: fix heap overflow in flow_action_entry_next()

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Sun, Mar 08, 2026 at 02:23:06AM +0900, Hyunwoo Kim wrote:
> flow_action_entry_next() increments num_entries and returns a pointer
> into the flow_action_entry array without any bounds checking.  The array
> is allocated with a fixed size of NF_FLOW_RULE_ACTION_MAX (16) entries,
> but certain combinations of IPv6 + SNAT + DNAT + double VLAN (QinQ)
> require 17 or more entries, causing a slab-out-of-bounds write in the
> kmalloc-4k slab.
> 
> The maximum possible entry count is:
>   tunnel(2) + eth(4) + VLAN(4) + IPv6_NAT(10) + redirect(1) = 21

There is no hardware offload for the:

- tunnel support
- IPv6 NAT

This is all very hypothetical.

> Increase NF_FLOW_RULE_ACTION_MAX to 24 (with headroom) to cover the
> worst case.
> 
> Fixes: efce49dfe6a8 ("netfilter: flowtable: add vlan pop action offload support")
> Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
> ---
>  net/netfilter/nf_flow_table_offload.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/net/netfilter/nf_flow_table_offload.c b/net/netfilter/nf_flow_table_offload.c
> index 9b677e116487..e843f6d0355e 100644
> --- a/net/netfilter/nf_flow_table_offload.c
> +++ b/net/netfilter/nf_flow_table_offload.c
> @@ -727,7 +727,7 @@ int nf_flow_rule_route_ipv6(struct net *net, struct flow_offload *flow,
>  }
>  EXPORT_SYMBOL_GPL(nf_flow_rule_route_ipv6);
>  
> -#define NF_FLOW_RULE_ACTION_MAX	16
> +#define NF_FLOW_RULE_ACTION_MAX	24
>  
>  static struct nf_flow_rule *
>  nf_flow_offload_rule_alloc(struct net *net,
> -- 
> 2.43.0
>