diff options
| author | Wyatt Feng <bronzed_45_vested@icloud.com> | 2026-06-28 16:05:54 +0800 |
|---|---|---|
| committer | Florian Westphal <fw@strlen.de> | 2026-07-03 14:45:21 +0200 |
| commit | 64cdf7d30ac18e43df6c48004435febb965809a8 (patch) | |
| tree | 8a46ab10dbc3a33752d828fdb421abbc5a2d999e /rust/zerocopy/src/pointer/git@git.tavy.me:linux-stable.git | |
| parent | 77e43bcb7ec177e293a5c3f1b91a2c5aebfb6c68 (diff) | |
netfilter: xt_u32: reject invalid shift counts
u32_match_it() executes rule-supplied shift operands on a 32-bit
value. A malformed u32 rule can provide a shift count of 32 or more,
triggering an undefined shift out-of-bounds during packet evaluation.
Validate XT_U32_LEFTSH and XT_U32_RIGHTSH operands in
u32_mt_checkentry() and reject malformed rules before they reach the
packet path.
Fixes: 1b50b8a371e9 ("[NETFILTER]: Add u32 match")
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Reported-by: Zhengchuan Liang <zcliangcn@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Assisted-by: Codex:GPT-5.4
Signed-off-by: Wyatt Feng <bronzed_45_vested@icloud.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Signed-off-by: Florian Westphal <fw@strlen.de>
Diffstat (limited to 'rust/zerocopy/src/pointer/git@git.tavy.me:linux-stable.git')
0 files changed, 0 insertions, 0 deletions