diff options
| author | Wyatt Feng <bronzed_45_vested@icloud.com> | 2026-07-03 13:04:46 +0800 |
|---|---|---|
| committer | Florian Westphal <fw@strlen.de> | 2026-07-03 14:45:21 +0200 |
| commit | 1b47026fb4b35bac850ad6e8a4ad7fc018e09ebc (patch) | |
| tree | d115783f8f335482b37511c066dc44ef46afad2c /rust/zerocopy/src/pointer/git@git.tavy.me:linux-stable.git | |
| parent | 2975324d164c552b028632f107b567302863b7f6 (diff) | |
netfilter: xt_connmark: reject invalid shift parameters
Revision 2 of the CONNMARK target accepts user-controlled shift
parameters and applies them to 32-bit mark values in
connmark_tg_shift().
A shift_bits value of 32 or more triggers an undefined-shift bug when
the rule is evaluated. Invalid shift_dir values are also accepted and
silently fall back to the left-shift path.
Reject invalid revision-2 shift parameters in connmark_tg_check() so
malformed rules fail at installation time, before they can reach the
packet path.
Fixes: 472a73e00757 ("netfilter: xt_conntrack: Support bit-shifting for CONNMARK & MARK targets.")
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Zhengchuan Liang <zcliangcn@gmail.com>
Reported-by: Xin Liu <dstsmallbird@foxmail.com>
Assisted-by: Codex:GPT-5.4
Signed-off-by: Wyatt Feng <bronzed_45_vested@icloud.com>
Reviewed-by: Ren Wei <enjou1224z@gmail.com>
Reviewed-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Florian Westphal <fw@strlen.de>
Diffstat (limited to 'rust/zerocopy/src/pointer/git@git.tavy.me:linux-stable.git')
0 files changed, 0 insertions, 0 deletions