netfilter: xt_nfacct: don't assume acct name is null-terminated

JIRA: https://issues.redhat.com/browse/RHEL-115630
Upstream Status: commit bf58e66

commit bf58e66
Author: Florian Westphal <fw@strlen.de>
Date:   Fri Jul 18 13:27:13 2025 +0200

    netfilter: xt_nfacct: don't assume acct name is null-terminated

    BUG: KASAN: slab-out-of-bounds in .. lib/vsprintf.c:721
    Read of size 1 at addr ffff88801eac95c8 by task syz-executor183/5851
    [..]
     string+0x231/0x2b0 lib/vsprintf.c:721
     vsnprintf+0x739/0xf00 lib/vsprintf.c:2874
     [..]
     nfacct_mt_checkentry+0xd2/0xe0 net/netfilter/xt_nfacct.c:41
     xt_check_match+0x3d1/0xab0 net/netfilter/x_tables.c:523

    nfnl_acct_find_get() handles non-null input, but the error
    printk relied on its presence.

    Reported-by: syzbot+4ff165b9251e4d295690@syzkaller.appspotmail.com
    Closes: https://syzkaller.appspot.com/bug?extid=4ff165b9251e4d295690
    Tested-by: syzbot+4ff165b9251e4d295690@syzkaller.appspotmail.com
    Fixes: ceb98d0 ("netfilter: xtables: add nfacct match to support extended accounting")
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

Signed-off-by: Florian Westphal <fwestpha@redhat.com>

Author: fw-strlen

net/netfilter/xt_nfacct.c

@@ -38,8 +38,8 @@ nfacct_mt_checkentry(const struct xt_mtchk_param *par)
 
 	nfacct = nfnl_acct_find_get(par->net, info->name);
 	if (nfacct == NULL) {
-		pr_info_ratelimited("accounting object `%s' does not exists\n",
-				    info->name);
+		pr_info_ratelimited("accounting object `%.*s' does not exist\n",
+				    NFACCT_NAME_MAX, info->name);
 		return -ENOENT;
 	}
 	info->nfacct = nfacct;