From a9469302e0f5583c2d4a0796bf8e723f2a90e01c Mon Sep 17 00:00:00 2001
From: Florian Westphal <fwestpha@redhat.com>
Date: Wed, 13 May 2026 17:20:51 +0200
Subject: [PATCH] netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE
 terminator

JIRA: https://redhat.atlassian.net/browse/RHEL-168848
Upstream Status: commit 1f3083aec883

commit 1f3083aec8836213da441270cdb1ab612dd82cf4
Author: Xiang Mei <xmei5@asu.edu>
Date:   Wed Apr 1 14:20:57 2026 -0700

    netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator

    When batching multiple NFLOG messages (inst->qlen > 1), __nfulnl_send()
    appends an NLMSG_DONE terminator with sizeof(struct nfgenmsg) payload via
    nlmsg_put(), but never initializes the nfgenmsg bytes. The nlmsg_put()
    helper only zeroes alignment padding after the payload, not the payload
    itself, so four bytes of stale kernel heap data are leaked to userspace
    in the NLMSG_DONE message body.

    Use nfnl_msg_put() to build the NLMSG_DONE terminator, which initializes
    the nfgenmsg payload via nfnl_fill_hdr(), consistent with how
    __build_packet_message() already constructs NFULNL_MSG_PACKET headers.

    Fixes: 29c5d4afba51 ("[NETFILTER]: nfnetlink_log: fix sending of multipart messages")
    Reported-by: Weiming Shi <bestswngs@gmail.com>
    Signed-off-by: Xiang Mei <xmei5@asu.edu>
    Signed-off-by: Florian Westphal <fw@strlen.de>

Signed-off-by: Florian Westphal <fwestpha@redhat.com>

diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index dcd2493..b1f3eda 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -361,10 +361,10 @@ static void
 __nfulnl_send(struct nfulnl_instance *inst)
 {
 	if (inst->qlen > 1) {
-		struct nlmsghdr *nlh = nlmsg_put(inst->skb, 0, 0,
-						 NLMSG_DONE,
-						 sizeof(struct nfgenmsg),
-						 0);
+		struct nlmsghdr *nlh = nfnl_msg_put(inst->skb, 0, 0,
+						    NLMSG_DONE, 0,
+						    AF_UNSPEC, NFNETLINK_V0,
+						    htons(inst->group_num));
 		if (WARN_ONCE(!nlh, "bad nlskb size: %u, tailroom %d\n",
 			      inst->skb->len, skb_tailroom(inst->skb))) {
 			kfree_skb(inst->skb);