[{"id":3676123,"web_url":"http://patchwork.ozlabs.org/comment/3676123/","msgid":"<6c09eeed-8f7f-4bd5-977e-a7b0da4b4cf4@suse.de>","list_archive_url":null,"date":"2026-04-11T07:56:05","subject":"Re: [PATCH nf] netfilter: nfnetlink_osf: fix divide-by-zero in\n OSF_WSS_MODULO","submitter":{"id":90904,"url":"http://patchwork.ozlabs.org/api/people/90904/","name":"Fernando Fernandez Mancera","email":"fmancera@suse.de"},"content":"On 4/10/26 10:48 PM, Xiang Mei wrote:\n> The OSF_WSS_MODULO branch in nf_osf_match_one() performs:\n> \n> ctx->window % f->wss.val\n> \n> without guarding against f->wss.val == 0. A user with CAP_NET_ADMIN\n> can add an OSF fingerprint with wss.wc = OSF_WSS_MODULO and wss.val = 0\n> via nfnetlink. When a matching TCP SYN packet arrives, the kernel\n> executes a division by zero and panics.\n> \n> The OSF_WSS_PLAIN case already treats val == 0 as a wildcard (match\n> everything). Apply the same semantics to OSF_WSS_MODULO: if val is 0,\n> any window value matches rather than dividing by zero.\n> \n> Crash:\n> Oops: divide error: 0000 [#1] SMP KASAN NOPTI\n> RIP: 0010:nf_osf_match_one (net/netfilter/nfnetlink_osf.c:98)\n> Call Trace:\n> \n> nf_osf_match (net/netfilter/nfnetlink_osf.c:220 (discriminator 6))\n> xt_osf_match_packet (net/netfilter/xt_osf.c:32)\n> ipt_do_table (net/ipv4/netfilter/ip_tables.c:348)\n> nf_hook_slow (net/netfilter/core.c:622 (discriminator 1))\n> ip_local_deliver (net/ipv4/ip_input.c:265)\n> ip_rcv (include/linux/skbuff.h:1162)\n> __netif_receive_skb_one_core (net/core/dev.c:6181)\n> process_backlog (.include/linux/skbuff.h:2502 net/core/dev.c:6642)\n> __napi_poll (net/core/dev.c:7710)\n> net_rx_action (net/core/dev.c:7945)\n> handle_softirqs (kernel/softirq.c:622)\n> \n> Fixes: 31a9c29210e2 (\"netfilter: nf_osf: add struct nf_osf_hdr_ctx\")\n> Reported-by: Weiming Shi \n> Signed-off-by: Xiang Mei \n\nLGTM, but I don't see this happening at all to be honest. Such \nfingerprint would be bogus anyway.\n\nThe fixes tag is not correct I think. This was introduced on \n11eeef41d5f6 (\"netfilter: passive OS fingerprint xtables match\") actually.\n\nReviewed-by: Fernando Fernandez Mancera ","headers":{"Return-Path":"\n ","X-Original-To":["incoming@patchwork.ozlabs.org","netfilter-devel@vger.kernel.org"],"Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (1024-bit key;\n unprotected) header.d=suse.de header.i=@suse.de header.a=rsa-sha256\n header.s=susede2_rsa header.b=qb24Z+Br;\n\tdkim=pass header.d=suse.de header.i=@suse.de header.a=ed25519-sha256\n header.s=susede2_ed25519 header.b=Mjirkspp;\n\tdkim=pass (1024-bit key) header.d=suse.de header.i=@suse.de\n header.a=rsa-sha256 header.s=susede2_rsa header.b=J7d6KbSk;\n\tdkim=neutral header.d=suse.de header.i=@suse.de header.a=ed25519-sha256\n header.s=susede2_ed25519 header.b=UjeuIZpc;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=104.64.211.4; helo=sin.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-11818-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)","smtp.subspace.kernel.org;\n\tdkim=pass (1024-bit key) header.d=suse.de header.i=@suse.de\n header.b=\"qb24Z+Br\";\n\tdkim=permerror (0-bit key) header.d=suse.de header.i=@suse.de\n header.b=\"Mjirkspp\";\n\tdkim=pass (1024-bit key) header.d=suse.de header.i=@suse.de\n header.b=\"J7d6KbSk\";\n\tdkim=permerror (0-bit key) header.d=suse.de header.i=@suse.de\n header.b=\"UjeuIZpc\"","smtp.subspace.kernel.org;\n arc=none smtp.client-ip=195.135.223.131","smtp.subspace.kernel.org;\n dmarc=pass (p=none dis=none) header.from=suse.de","smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=suse.de","smtp-out2.suse.de;\n\tnone"],"Received":["from sin.lore.kernel.org (sin.lore.kernel.org [104.64.211.4])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4ft5bH33xfz1y2d\n\tfor ; Sat, 11 Apr 2026 17:56:27 +1000 (AEST)","from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sin.lore.kernel.org (Postfix) with ESMTP id 3569F300E692\n\tfor ; Sat, 11 Apr 2026 07:56:23 +0000 (UTC)","from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id 51EE833688E;\n\tSat, 11 Apr 2026 07:56:19 +0000 (UTC)","from smtp-out2.suse.de (smtp-out2.suse.de [195.135.223.131])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id A57811B4F1F\n\tfor ; Sat, 11 Apr 2026 07:56:17 +0000 (UTC)","from imap1.dmz-prg2.suse.org (unknown [10.150.64.97])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest\n SHA256)\n\t(No client certificate requested)\n\tby smtp-out2.suse.de (Postfix) with ESMTPS id D75805BCE9;\n\tSat, 11 Apr 2026 07:56:15 +0000 (UTC)","from imap1.dmz-prg2.suse.org (localhost [127.0.0.1])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest\n SHA256)\n\t(No client certificate requested)\n\tby imap1.dmz-prg2.suse.org (Postfix) with ESMTPS id 654DC4A0A3;\n\tSat, 11 Apr 2026 07:56:15 +0000 (UTC)","from dovecot-director2.suse.de ([2a07:de40:b281:106:10:150:64:167])\n\tby imap1.dmz-prg2.suse.org with ESMTPSA\n\tid ZaFwFZ/+2WkkUQAAD6G6ig\n\t(envelope-from ); Sat, 11 Apr 2026 07:56:15 +0000"],"ARC-Seal":"i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1775894178; cv=none;\n b=WXg44etF0Q0I1QATMcaKyuxetsUEp5BKhQ8RAlu20cDut6d3HpOzEAOsZuQ+z3/4waQBcg7zGXecKjMZ1wOmYIk/7I5WRQUiB/qjXz0IK8wBx7Kppk4UTP8IT7V3zvOBYkVhbKOiI+JxatZhTnaWnWdkVHbVOpPnyVZ++o0DOgI=","ARC-Message-Signature":"i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1775894178; c=relaxed/simple;\n\tbh=4EyWVh+sqba13i3DcNNp9IktKUHkroxhfrmheQLss3Y=;\n\th=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From:\n\t In-Reply-To:Content-Type;\n b=HrXH4O6Ay6OwKemXSyD6wsQUkWRTzr5+tNQLtchNntRkExIMv+OoDlhR7iHLoFpmA/20/Kfbjzv/l7Y+5FDDpRe8jf6B798yxX5lwl+JJX1B/twNzDNd9joBuU12SSJaDKZKZqquz+NO34zRLBxILIpvvqbIbwun8VYLec5wGFg=","ARC-Authentication-Results":"i=1; smtp.subspace.kernel.org;\n dmarc=pass (p=none dis=none) header.from=suse.de;\n spf=pass smtp.mailfrom=suse.de;\n dkim=pass (1024-bit key) header.d=suse.de header.i=@suse.de\n header.b=qb24Z+Br;\n dkim=permerror (0-bit key) header.d=suse.de header.i=@suse.de\n header.b=Mjirkspp;\n dkim=pass (1024-bit key) header.d=suse.de header.i=@suse.de\n header.b=J7d6KbSk;\n dkim=permerror (0-bit key) header.d=suse.de header.i=@suse.de\n header.b=UjeuIZpc; arc=none smtp.client-ip=195.135.223.131","DKIM-Signature":["v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.de;\n s=susede2_rsa;\n\tt=1775894176;\n h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc:\n\t mime-version:mime-version:content-type:content-type:\n\t content-transfer-encoding:content-transfer-encoding:\n\t in-reply-to:in-reply-to:references:references;\n\tbh=y9ogqdpWFxG/8VwOBBIyYhZvg5tUZjc7AasSF5vpd7A=;\n\tb=qb24Z+BraCaE4cMlOJtjsCGAzKmrAyONAbUCicRt/MuK98xvm9HKX65twso/PjVmLvFBGU\n\t4Jv3BFbB2oWxCw2xcHyssm6vPuYF7WL9rrgQ75HCRnpwJoVAfTwOMRthNSWmOEbA5kR25h\n\tPdzCBXEj/odzq4Ea8WRzhSmE8c7blks=","v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.de;\n\ts=susede2_ed25519; t=1775894176;\n\th=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc:\n\t mime-version:mime-version:content-type:content-type:\n\t content-transfer-encoding:content-transfer-encoding:\n\t in-reply-to:in-reply-to:references:references;\n\tbh=y9ogqdpWFxG/8VwOBBIyYhZvg5tUZjc7AasSF5vpd7A=;\n\tb=MjirksppC3nBQPVW0CcCZnGaSvpQNvyv92xZO26zJ9cr84g3gFQJHgDj9ENDSViqqgxBPK\n\tPvurOfvUfHkD0yAw==","v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.de;\n s=susede2_rsa;\n\tt=1775894175;\n h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc:\n\t mime-version:mime-version:content-type:content-type:\n\t content-transfer-encoding:content-transfer-encoding:\n\t in-reply-to:in-reply-to:references:references;\n\tbh=y9ogqdpWFxG/8VwOBBIyYhZvg5tUZjc7AasSF5vpd7A=;\n\tb=J7d6KbSknOX6B6fRrPAqsdPTDmnrNB96OilGXL7FKECpWJLZu2jmr4Dxzys2UYxwte/bvN\n\ts9soegb36+p9ng8UcYvp2ojl8aRGTwtY9vNh/zCe1H0rsBdif2x43+myUb0p1giIZ5NzW5\n\tSknFe+w7ffTqbhUrvKuW5dS7QvjX7XM=","v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.de;\n\ts=susede2_ed25519; t=1775894175;\n\th=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc:\n\t mime-version:mime-version:content-type:content-type:\n\t content-transfer-encoding:content-transfer-encoding:\n\t in-reply-to:in-reply-to:references:references;\n\tbh=y9ogqdpWFxG/8VwOBBIyYhZvg5tUZjc7AasSF5vpd7A=;\n\tb=UjeuIZpcHFMtM2ZZ7K+/pmImroyk8tAX7tsr4eQgNHjBv51Fwrz1322oVp/MkvrjLbt09f\n\t4c60rn/d4lcrzyDQ=="],"Message-ID":"<6c09eeed-8f7f-4bd5-977e-a7b0da4b4cf4@suse.de>","Date":"Sat, 11 Apr 2026 09:56:05 +0200","Precedence":"bulk","X-Mailing-List":"netfilter-devel@vger.kernel.org","List-Id":"","List-Subscribe":"","List-Unsubscribe":"","MIME-Version":"1.0","User-Agent":"Mozilla Thunderbird","Subject":"Re: [PATCH nf] netfilter: nfnetlink_osf: fix divide-by-zero in\n OSF_WSS_MODULO","To":"Xiang Mei , netfilter-devel@vger.kernel.org","Cc":"Pablo Neira Ayuso , Florian Westphal ,\n Phil Sutter , coreteam@netfilter.org,\n Weiming Shi ","References":"<20260410204843.64259-1-xmei5@asu.edu>","Content-Language":"en-US","From":"Fernando Fernandez Mancera ","In-Reply-To":"<20260410204843.64259-1-xmei5@asu.edu>","Content-Type":"text/plain; charset=UTF-8; format=flowed","Content-Transfer-Encoding":"7bit","X-Spam-Score":"-4.29","X-Spam-Level":"","X-Spamd-Result":"default: False [-4.29 / 50.00];\n\tBAYES_HAM(-3.00)[100.00%];\n\tNEURAL_HAM_LONG(-1.00)[-1.000];\n\tNEURAL_HAM_SHORT(-0.19)[-0.933];\n\tMIME_GOOD(-0.10)[text/plain];\n\tRCVD_VIA_SMTP_AUTH(0.00)[];\n\tRCVD_TLS_ALL(0.00)[];\n\tARC_NA(0.00)[];\n\tMIME_TRACE(0.00)[0:+];\n\tRCPT_COUNT_SEVEN(0.00)[7];\n\tFUZZY_RATELIMITED(0.00)[rspamd.com];\n\tMID_RHS_MATCH_FROM(0.00)[];\n\tFREEMAIL_ENVRCPT(0.00)[gmail.com];\n\tDKIM_SIGNED(0.00)[suse.de:s=susede2_rsa,suse.de:s=susede2_ed25519];\n\tFROM_HAS_DN(0.00)[];\n\tFREEMAIL_CC(0.00)[netfilter.org,strlen.de,nwl.cc,gmail.com];\n\tTO_DN_SOME(0.00)[];\n\tFROM_EQ_ENVFROM(0.00)[];\n\tTO_MATCH_ENVRCPT_ALL(0.00)[];\n\tRCVD_COUNT_TWO(0.00)[2];\n\tDBL_BLOCKED_OPENRESOLVER(0.00)[suse.de:mid,suse.de:email]","X-Spam-Flag":"NO"}},{"id":3676205,"web_url":"http://patchwork.ozlabs.org/comment/3676205/","msgid":"","list_archive_url":null,"date":"2026-04-11T20:41:32","subject":"Re: [PATCH nf] netfilter: nfnetlink_osf: fix divide-by-zero in\n OSF_WSS_MODULO","submitter":{"id":1025,"url":"http://patchwork.ozlabs.org/api/people/1025/","name":"Florian Westphal","email":"fw@strlen.de"},"content":"Xiang Mei wrote:\n> The OSF_WSS_MODULO branch in nf_osf_match_one() performs:\n> \n> ctx->window % f->wss.val\n> \n> without guarding against f->wss.val == 0. A user with CAP_NET_ADMIN\n> can add an OSF fingerprint with wss.wc = OSF_WSS_MODULO and wss.val = 0\n> via nfnetlink. When a matching TCP SYN packet arrives, the kernel\n> executes a division by zero and panics.\n> \n> The OSF_WSS_PLAIN case already treats val == 0 as a wildcard (match\n> everything). Apply the same semantics to OSF_WSS_MODULO: if val is 0,\n> any window value matches rather than dividing by zero.\n> \n> Crash:\n> Oops: divide error: 0000 [#1] SMP KASAN NOPTI\n> RIP: 0010:nf_osf_match_one (net/netfilter/nfnetlink_osf.c:98)\n> Call Trace:\n> \n> nf_osf_match (net/netfilter/nfnetlink_osf.c:220 (discriminator 6))\n> xt_osf_match_packet (net/netfilter/xt_osf.c:32)\n> ipt_do_table (net/ipv4/netfilter/ip_tables.c:348)\n> nf_hook_slow (net/netfilter/core.c:622 (discriminator 1))\n> ip_local_deliver (net/ipv4/ip_input.c:265)\n> ip_rcv (include/linux/skbuff.h:1162)\n> __netif_receive_skb_one_core (net/core/dev.c:6181)\n> process_backlog (.include/linux/skbuff.h:2502 net/core/dev.c:6642)\n> __napi_poll (net/core/dev.c:7710)\n> net_rx_action (net/core/dev.c:7945)\n> handle_softirqs (kernel/softirq.c:622)\n> \n> Fixes: 31a9c29210e2 (\"netfilter: nf_osf: add struct nf_osf_hdr_ctx\")\n\nHmm, why? AFAICS the bug was there from start:\n\n11eeef41d5f63 case OSF_WSS_MODULO:\n11eeef41d5f63 if ((window % f->wss.val) == 0)\n11eeef41d5f63 fmatch = FMATCH_OK;\n\nSo:\nFixes: 11eeef41d5f6 (\"netfilter: passive OS fingerprint xtables match\")\n\n> diff --git a/net/netfilter/nfnetlink_osf.c b/net/netfilter/nfnetlink_osf.c\n> index 45d9ad231..193436aa9 100644\n> --- a/net/netfilter/nfnetlink_osf.c\n> +++ b/net/netfilter/nfnetlink_osf.c\n> @@ -150,7 +150,7 @@ static bool nf_osf_match_one(const struct sk_buff *skb,\n> \t\t\t\tfmatch = FMATCH_OK;\n> \t\t\tbreak;\n> \t\tcase OSF_WSS_MODULO:\n> -\t\t\tif ((ctx->window % f->wss.val) == 0)\n> +\t\t\tif (f->wss.val == 0 || (ctx->window % f->wss.val) == 0)\n\nCould you send a v2 that rejects this from control plane instead?\nNobody is using a 0 value, else we'd have gotted such crash reports by\nnow.","headers":{"Return-Path":"\n ","X-Original-To":["incoming@patchwork.ozlabs.org","netfilter-devel@vger.kernel.org"],"Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=172.232.135.74; helo=sto.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-11824-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)","smtp.subspace.kernel.org;\n arc=none smtp.client-ip=91.216.245.30","smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=strlen.de","smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=strlen.de"],"Received":["from sto.lore.kernel.org (sto.lore.kernel.org [172.232.135.74])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4ftQZG0BT3z1yGb\n\tfor ; Sun, 12 Apr 2026 06:41:41 +1000 (AEST)","from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sto.lore.kernel.org (Postfix) with ESMTP id 885CB30164CF\n\tfor ; Sat, 11 Apr 2026 20:41:38 +0000 (UTC)","from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id 589503033FD;\n\tSat, 11 Apr 2026 20:41:37 +0000 (UTC)","from Chamillionaire.breakpoint.cc (Chamillionaire.breakpoint.cc\n [91.216.245.30])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id C2DCE23C8C7\n\tfor ; Sat, 11 Apr 2026 20:41:34 +0000 (UTC)","by Chamillionaire.breakpoint.cc (Postfix, from userid 1003)\n\tid AA40D60491; Sat, 11 Apr 2026 22:41:32 +0200 (CEST)"],"ARC-Seal":"i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1775940097; cv=none;\n b=p/BNg8gQiVJCcXF6ADyAED/l7NOMbPYqtV58EMVU07rC1nstRujpXMW4zMxKnlHFohjLj1MLE6/NFYPiNpU0fhTLKSSN6geRTQgrUz9VK/UqlHdwAmv9M/WBVs9OjNkeGhw9DtCaaSnQVwhweoWAcAX8jQOru5r9uyvpNZtor4E=","ARC-Message-Signature":"i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1775940097; c=relaxed/simple;\n\tbh=k3uSAKgJ5e+kSEYFPOzcdC5jfSTGDfjv4S4sFkIOF+E=;\n\th=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version:\n\t Content-Type:Content-Disposition:In-Reply-To;\n b=jJTK1Fhgx6xahjF/jJCIh+L9vDWccgjzQWQhLKmWVLWrio8hgu4pRIk1bMoSv4MNiC+HkG7xHUK1j83c0uWhez75g5jMBquToIehD3Sd9lvTmDSvkfvEOoGLF5JBS3msbB1Y/IYYxaFQV0KPA7lgK4vWkzRH38wuulgvT0ePWNs=","ARC-Authentication-Results":"i=1; smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=strlen.de;\n spf=pass smtp.mailfrom=strlen.de; arc=none smtp.client-ip=91.216.245.30","Date":"Sat, 11 Apr 2026 22:41:32 +0200","From":"Florian Westphal ","To":"Xiang Mei ","Cc":"netfilter-devel@vger.kernel.org,\n\tPablo Neira Ayuso , Phil Sutter ,\n\tcoreteam@netfilter.org, Weiming Shi ","Subject":"Re: [PATCH nf] netfilter: nfnetlink_osf: fix divide-by-zero in\n OSF_WSS_MODULO","Message-ID":"","References":"<20260410204843.64259-1-xmei5@asu.edu>","Precedence":"bulk","X-Mailing-List":"netfilter-devel@vger.kernel.org","List-Id":"","List-Subscribe":"","List-Unsubscribe":"","MIME-Version":"1.0","Content-Type":"text/plain; charset=us-ascii","Content-Disposition":"inline","In-Reply-To":"<20260410204843.64259-1-xmei5@asu.edu>"}},{"id":3677125,"web_url":"http://patchwork.ozlabs.org/comment/3677125/","msgid":"","list_archive_url":null,"date":"2026-04-14T11:01:41","subject":"Re: [PATCH nf] netfilter: nfnetlink_osf: fix divide-by-zero in\n OSF_WSS_MODULO","submitter":{"id":1315,"url":"http://patchwork.ozlabs.org/api/people/1315/","name":"Pablo Neira Ayuso","email":"pablo@netfilter.org"},"content":"On Sat, Apr 11, 2026 at 10:41:32PM +0200, Florian Westphal wrote:\n> Xiang Mei wrote:\n> > The OSF_WSS_MODULO branch in nf_osf_match_one() performs:\n> > \n> > ctx->window % f->wss.val\n> > \n> > without guarding against f->wss.val == 0. A user with CAP_NET_ADMIN\n> > can add an OSF fingerprint with wss.wc = OSF_WSS_MODULO and wss.val = 0\n> > via nfnetlink. When a matching TCP SYN packet arrives, the kernel\n> > executes a division by zero and panics.\n> > \n> > The OSF_WSS_PLAIN case already treats val == 0 as a wildcard (match\n> > everything). Apply the same semantics to OSF_WSS_MODULO: if val is 0,\n> > any window value matches rather than dividing by zero.\n> > \n> > Crash:\n> > Oops: divide error: 0000 [#1] SMP KASAN NOPTI\n> > RIP: 0010:nf_osf_match_one (net/netfilter/nfnetlink_osf.c:98)\n> > Call Trace:\n> > \n> > nf_osf_match (net/netfilter/nfnetlink_osf.c:220 (discriminator 6))\n> > xt_osf_match_packet (net/netfilter/xt_osf.c:32)\n> > ipt_do_table (net/ipv4/netfilter/ip_tables.c:348)\n> > nf_hook_slow (net/netfilter/core.c:622 (discriminator 1))\n> > ip_local_deliver (net/ipv4/ip_input.c:265)\n> > ip_rcv (include/linux/skbuff.h:1162)\n> > __netif_receive_skb_one_core (net/core/dev.c:6181)\n> > process_backlog (.include/linux/skbuff.h:2502 net/core/dev.c:6642)\n> > __napi_poll (net/core/dev.c:7710)\n> > net_rx_action (net/core/dev.c:7945)\n> > handle_softirqs (kernel/softirq.c:622)\n> > \n> > Fixes: 31a9c29210e2 (\"netfilter: nf_osf: add struct nf_osf_hdr_ctx\")\n> \n> Hmm, why? AFAICS the bug was there from start:\n> \n> 11eeef41d5f63 case OSF_WSS_MODULO:\n> 11eeef41d5f63 if ((window % f->wss.val) == 0)\n> 11eeef41d5f63 fmatch = FMATCH_OK;\n> \n> So:\n> Fixes: 11eeef41d5f6 (\"netfilter: passive OS fingerprint xtables match\")\n> \n> > diff --git a/net/netfilter/nfnetlink_osf.c b/net/netfilter/nfnetlink_osf.c\n> > index 45d9ad231..193436aa9 100644\n> > --- a/net/netfilter/nfnetlink_osf.c\n> > +++ b/net/netfilter/nfnetlink_osf.c\n> > @@ -150,7 +150,7 @@ static bool nf_osf_match_one(const struct sk_buff *skb,\n> > \t\t\t\tfmatch = FMATCH_OK;\n> > \t\t\tbreak;\n> > \t\tcase OSF_WSS_MODULO:\n> > -\t\t\tif ((ctx->window % f->wss.val) == 0)\n> > +\t\t\tif (f->wss.val == 0 || (ctx->window % f->wss.val) == 0)\n> \n> Could you send a v2 that rejects this from control plane instead?\n> Nobody is using a 0 value, else we'd have gotted such crash reports by\n> now.\n\nNo news from this, I think this should be fine:\n\n@@ -329,6 +332,15 @@ static int nfnl_osf_add_callback(struct sk_buff *skb,\n if (f->opt[i].kind == OSFOPT_MSS && f->opt[i].length < 4)\n return -EINVAL;\n \n+ switch (f->wss.wc) {\n+ case OSF_WSS_MODULO:\n+ if (f->wss.val == 0)\n+ return -EINVAL;\n+ break;\n+ default:\n+ break;\n+ }\n+\n tot_opt_len += f->opt[i].length;\n if (tot_opt_len > MAX_IPOPTLEN)\n return -EINVAL;\n\nIf no concerns, I will post a patch.","headers":{"Return-Path":"\n ","X-Original-To":["incoming@patchwork.ozlabs.org","netfilter-devel@vger.kernel.org"],"Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=netfilter.org header.i=@netfilter.org\n header.a=rsa-sha256 header.s=2025 header.b=t6cTpEa2;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c04:e001:36c::12fc:5321; helo=tor.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-11867-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)","smtp.subspace.kernel.org;\n\tdkim=pass (2048-bit key) header.d=netfilter.org header.i=@netfilter.org\n header.b=\"t6cTpEa2\"","smtp.subspace.kernel.org;\n arc=none smtp.client-ip=217.70.190.124","smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=netfilter.org","smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=netfilter.org"],"Received":["from tor.lore.kernel.org (tor.lore.kernel.org\n [IPv6:2600:3c04:e001:36c::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fw1ZQ54ryz1yDF\n\tfor ; Tue, 14 Apr 2026 21:02:22 +1000 (AEST)","from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby tor.lore.kernel.org (Postfix) with ESMTP id 924A2300F963\n\tfor ; Tue, 14 Apr 2026 11:01:52 +0000 (UTC)","from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id 73AAC3D649D;\n\tTue, 14 Apr 2026 11:01:49 +0000 (UTC)","from mail.netfilter.org (mail.netfilter.org [217.70.190.124])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id 1191D1FC8\n\tfor ; Tue, 14 Apr 2026 11:01:46 +0000 (UTC)","from netfilter.org (mail-agni [217.70.190.124])\n\tby mail.netfilter.org (Postfix) with UTF8SMTPSA id 85D1B6029D;\n\tTue, 14 Apr 2026 13:01:44 +0200 (CEST)"],"ARC-Seal":"i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1776164509; cv=none;\n b=Xk6rOIsfe+j7yPsj0OvSt5rzM5EuFldTjwaOYQCV6qjyFG81AgNfxwxAxyqEoo4kXsRyo8j67nNxZWHyKbTEL0B3P3IWfK6wsmSN0eOdZw7wIX+tpza5NLQZ40bdgF/7Ay8x5Cnn9UHrRcJRbK2pNdQklj+N7co//upzfrXagB8=","ARC-Message-Signature":"i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1776164509; c=relaxed/simple;\n\tbh=T7VDJVh2O0J+Y2tZm1NJ0ilmYH+PI4oHbOMAF0xcgaM=;\n\th=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version:\n\t Content-Type:Content-Disposition:In-Reply-To;\n b=eDzv0VrNUI4WvQRUaI9pyheIW5BNVPijbgVuHwE+JKA8pu33YooeTDEF/wj1gz7/50TCGm9C7Qiuek0lnQNWFvaU6sySEo3gCn8SFw4vYdbkIHSOTHNBxqr+2BZ1gUzdpOi0BOvY99ZaGWxvCZQemDDLkNHqpY9QLbK30EX1eLM=","ARC-Authentication-Results":"i=1; smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=netfilter.org;\n spf=pass smtp.mailfrom=netfilter.org;\n dkim=pass (2048-bit key) header.d=netfilter.org header.i=@netfilter.org\n header.b=t6cTpEa2; arc=none smtp.client-ip=217.70.190.124","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=netfilter.org;\n\ts=2025; t=1776164504;\n\tbh=O7NY5SMDmUQsmmP/GFz1mPR9K95WBtcjGq5R6S6F5dg=;\n\th=Date:From:To:Cc:Subject:References:In-Reply-To:From;\n\tb=t6cTpEa2+PWDpqEUr6zhmd+6dEbyAAXNeobrCG8aYmfCNNhpAp0YQAPFpUQ2/eMx3\n\t fzsc8RiRiZBDfMSCeUpaONqjgFl9EgRYEanlC2XYDg3AJ5JD2rD8Q0fVsudzaXYv99\n\t 8/BlacpiM87m5R2A5K3pGRowjxenFe/d32Rv0EeLtVd1aDsZnC5OBBzEGMPfBOa9L3\n\t i3AdbwT+Quqs5tEYo7cQjeNPMbk8bXwXhJzrTALHiLp5Wg+F44MlJLDO8Y2ktpMSOj\n\t uxkHf3MqJbErKa2/x3jq2cP24POXuBE7kg7R8VzPdtBV2/WWWn/6LVfVeKJttz5SiT\n\t k3bTj+WVi3IuA==","Date":"Tue, 14 Apr 2026 13:01:41 +0200","From":"Pablo Neira Ayuso ","To":"Florian Westphal ","Cc":"Xiang Mei , netfilter-devel@vger.kernel.org,\n\tPhil Sutter , coreteam@netfilter.org,\n\tWeiming Shi ","Subject":"Re: [PATCH nf] netfilter: nfnetlink_osf: fix divide-by-zero in\n OSF_WSS_MODULO","Message-ID":"","References":"<20260410204843.64259-1-xmei5@asu.edu>\n ","Precedence":"bulk","X-Mailing-List":"netfilter-devel@vger.kernel.org","List-Id":"","List-Subscribe":"","List-Unsubscribe":"","MIME-Version":"1.0","Content-Type":"text/plain; charset=utf-8","Content-Disposition":"inline","In-Reply-To":""}},{"id":3677132,"web_url":"http://patchwork.ozlabs.org/comment/3677132/","msgid":"","list_archive_url":null,"date":"2026-04-14T11:11:58","subject":"Re: [PATCH nf] netfilter: nfnetlink_osf: fix divide-by-zero in\n OSF_WSS_MODULO","submitter":{"id":1025,"url":"http://patchwork.ozlabs.org/api/people/1025/","name":"Florian Westphal","email":"fw@strlen.de"},"content":"Pablo Neira Ayuso wrote:\n> @@ -329,6 +332,15 @@ static int nfnl_osf_add_callback(struct sk_buff *skb,\n> if (f->opt[i].kind == OSFOPT_MSS && f->opt[i].length < 4)\n> return -EINVAL;\n> \n> + switch (f->wss.wc) {\n> + case OSF_WSS_MODULO:\n> + if (f->wss.val == 0)\n> + return -EINVAL;\n> + break;\n> + default:\n> + break;\n> + }\n> +\n> tot_opt_len += f->opt[i].length;\n> if (tot_opt_len > MAX_IPOPTLEN)\n> return -EINVAL;\n> \n> If no concerns, I will post a patch.\n\nThanks Pablo, LGTM.","headers":{"Return-Path":"\n ","X-Original-To":["incoming@patchwork.ozlabs.org","netfilter-devel@vger.kernel.org"],"Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c09:e001:a7::12fc:5321; helo=sto.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-11869-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)","smtp.subspace.kernel.org;\n arc=none smtp.client-ip=91.216.245.30","smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=strlen.de","smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=strlen.de"],"Received":["from sto.lore.kernel.org (sto.lore.kernel.org\n [IPv6:2600:3c09:e001:a7::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fw1np4nrHz1xtJ\n\tfor ; Tue, 14 Apr 2026 21:12:14 +1000 (AEST)","from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sto.lore.kernel.org (Postfix) with ESMTP id B85873008C1E\n\tfor ; Tue, 14 Apr 2026 11:12:11 +0000 (UTC)","from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id 266673D8135;\n\tTue, 14 Apr 2026 11:12:09 +0000 (UTC)","from Chamillionaire.breakpoint.cc (Chamillionaire.breakpoint.cc\n [91.216.245.30])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id ACF06392822\n\tfor ; Tue, 14 Apr 2026 11:12:06 +0000 (UTC)","by Chamillionaire.breakpoint.cc (Postfix, from userid 1003)\n\tid 921B8608DB; Tue, 14 Apr 2026 13:11:58 +0200 (CEST)"],"ARC-Seal":"i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1776165128; cv=none;\n b=ixy/kWCBkh6rtLNSy7QKN5qp82SO+yTEZe7LqXZAOGyeLN1AXJExbq1Hb4aAEuK5mMPYRGfCJPhYFwOpJmZg1f/BhGQxcqDhtedHfngIa/u9JkVeYS3RHa2O3FwWnBxAJxOJM76LOomfvh8INbGiRIh6iw7OXaDWVAyAvBne2yY=","ARC-Message-Signature":"i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1776165128; c=relaxed/simple;\n\tbh=dlZx45gGzV7JW5rnpIgAxpeIcAYdiMFddyH2ix+2cMk=;\n\th=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version:\n\t Content-Type:Content-Disposition:In-Reply-To;\n b=VJ9uR7690fMoGQ6ZVR0JdoTGAgilyY+gQMI4IxKmaeLyikbqGg4ua6shyuwbUADm0SzpyRQHWRb8speRW5nmrhmtcIctkHPq7GmOF3j8NeIh5Rv9Aru9Ww/J/CmniXMbOUejFIGEvu/BWri74RqvbqLkbkxosveDZGK2k55pU/E=","ARC-Authentication-Results":"i=1; smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=strlen.de;\n spf=pass smtp.mailfrom=strlen.de; arc=none smtp.client-ip=91.216.245.30","Date":"Tue, 14 Apr 2026 13:11:58 +0200","From":"Florian Westphal ","To":"Pablo Neira Ayuso ","Cc":"Xiang Mei , netfilter-devel@vger.kernel.org,\n\tPhil Sutter , coreteam@netfilter.org,\n\tWeiming Shi ","Subject":"Re: [PATCH nf] netfilter: nfnetlink_osf: fix divide-by-zero in\n OSF_WSS_MODULO","Message-ID":"","References":"<20260410204843.64259-1-xmei5@asu.edu>\n \n ","Precedence":"bulk","X-Mailing-List":"netfilter-devel@vger.kernel.org","List-Id":"","List-Subscribe":"","List-Unsubscribe":"","MIME-Version":"1.0","Content-Type":"text/plain; charset=us-ascii","Content-Disposition":"inline","In-Reply-To":""}},{"id":3677413,"web_url":"http://patchwork.ozlabs.org/comment/3677413/","msgid":"","list_archive_url":null,"date":"2026-04-14T22:00:33","subject":"Re: [PATCH nf] netfilter: nfnetlink_osf: fix divide-by-zero in\n OSF_WSS_MODULO","submitter":{"id":93033,"url":"http://patchwork.ozlabs.org/api/people/93033/","name":"Xiang Mei","email":"xmei5@asu.edu"},"content":"Sorry for the delayed reply.\nThanks for the suggestion to patch it in the configuration path and\nfor correcting the fix commit.\nv2 would be sent ASAP.\n\nOn Tue, Apr 14, 2026 at 4:12 AM Florian Westphal wrote:\n>\n> Pablo Neira Ayuso wrote:\n> > @@ -329,6 +332,15 @@ static int nfnl_osf_add_callback(struct sk_buff *skb,\n> > if (f->opt[i].kind == OSFOPT_MSS && f->opt[i].length < 4)\n> > return -EINVAL;\n> >\n> > + switch (f->wss.wc) {\n> > + case OSF_WSS_MODULO:\n> > + if (f->wss.val == 0)\n> > + return -EINVAL;\n> > + break;\n> > + default:\n> > + break;\n> > + }\n> > +\n> > tot_opt_len += f->opt[i].length;\n> > if (tot_opt_len > MAX_IPOPTLEN)\n> > return -EINVAL;\n> >\n> > If no concerns, I will post a patch.\n>\n> Thanks Pablo, LGTM.","headers":{"Return-Path":"\n ","X-Original-To":["incoming@patchwork.ozlabs.org","netfilter-devel@vger.kernel.org"],"Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=asu.edu header.i=@asu.edu header.a=rsa-sha256\n header.s=google header.b=AeX7psOB;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c15:e001:75::12fc:5321; helo=sin.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-11895-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)","smtp.subspace.kernel.org;\n\tdkim=pass (2048-bit key) header.d=asu.edu header.i=@asu.edu\n header.b=\"AeX7psOB\"","smtp.subspace.kernel.org;\n arc=pass smtp.client-ip=209.85.215.180","smtp.subspace.kernel.org;\n dmarc=pass (p=none dis=none) header.from=asu.edu","smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=asu.edu"],"Received":["from sin.lore.kernel.org (sin.lore.kernel.org\n [IPv6:2600:3c15:e001:75::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fwJBH4LKVz1yCv\n\tfor ; Wed, 15 Apr 2026 08:00:55 +1000 (AEST)","from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sin.lore.kernel.org (Postfix) with ESMTP id 4AB453019D9D\n\tfor ; Tue, 14 Apr 2026 22:00:51 +0000 (UTC)","from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id 0D109389108;\n\tTue, 14 Apr 2026 22:00:48 +0000 (UTC)","from mail-pg1-f180.google.com (mail-pg1-f180.google.com\n [209.85.215.180])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id 65092282F14\n\tfor ; Tue, 14 Apr 2026 22:00:46 +0000 (UTC)","by mail-pg1-f180.google.com with SMTP id\n 41be03b00d2f7-c742d4df00cso2254276a12.1\n for ;\n Tue, 14 Apr 2026 15:00:46 -0700 (PDT)"],"ARC-Seal":["i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1776204047; cv=pass;\n b=doj5tBEMGfgZAHW2ExsqO4eSiOOzvL4l2AVfurpabPc/6BQimws76UlsLOXVsTnsaeqoFcM5CcEXcarsNWl4r5tSo1kFxW5i5Mxh682+hkYM2ZXgLGDHOmeUHeV7IV7uygoh7/qZzwNZM4ktdvoqkFQruHFlrZW0Wa0WsnVDUO0=","i=1; a=rsa-sha256; t=1776204046; cv=none;\n d=google.com; s=arc-20240605;\n b=G3xTo9jdG+yLap5Y+nrwj/Ubx/v5r5RdI7jcSvd95dTZZ86eisIQ1AYq7AJ7zyLWCV\n LMF0myyEhXNJ9PMlYfc371qOReXBGo/160S3T6mkd40UY7t8GsibmxRll5IAD65VUfgw\n 8MvbZPfEzSnLg2fc+nJrQKYcKgSK9wPzvgfZU2p9PlVpyaiOv2E1oa3WxknVxOVI45VE\n We76XK2AjFa66RiehcXcEnWEwGbqI5QIYn+F9dW2NKmr6xtbm33NaMerOFvhJP/hHF1b\n kbSb/803HBlzxbKMJqP1uP8EVt47+R2nRppa1Rtcr/UYldchuhLjYBG+JlhlEwl9csop\n cGHw=="],"ARC-Message-Signature":["i=2; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1776204047; c=relaxed/simple;\n\tbh=sz/F8/PmZFkJxJpabbbK1Zb7efc7hQIJsQZyrtNMs54=;\n\th=MIME-Version:References:In-Reply-To:From:Date:Message-ID:Subject:\n\t To:Cc:Content-Type;\n b=Hyb65swziHt6P7fFzCjsGMH4pjV8YcWjR4F6VMoh2TYwM/IeZG2W0Wgwg53JnstFq8Wdiz6t4T1nR+NISscbHBP/2Dna+TByuJf0Hf0XskUsxXF7l94on5LG5NWp4uFXL+zypti7a59FXV+HIu2bmTl+cmic2tVvDT7nNo4d+UA=","i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com;\n s=arc-20240605;\n h=content-transfer-encoding:cc:to:subject:message-id:date:from\n :in-reply-to:references:mime-version:dkim-signature;\n bh=ceZIdMhLRnh9RyYVBOqFR3dRVpkiUcZi/iUWMzpGHAU=;\n fh=w1iQL2KaBpWAGuXlFl4v9F9HVqIXZwc+vWD2qbDmRNM=;\n b=ivr3vyHBL3Xrhwk2vCnZ8UFXWLTpGwfvdmNu5r2Bkk89WqRLElxZpjxQSeo75HVaHw\n m44FGu9hdJjRh7BrCMxYoqGsOF+dHHmFVjEDViVGQ9ZehP0/moT+AjIX22NrzKsDleHE\n y6J4l4OqrsLWctLAxICdf116Gj64NnhKTk9bf8ulxAM3B9N+JbeFgDp6B3D0xGs/nphw\n YAeUOU3iIZ6ihgVVIWufiy0wUz07LSNizbmDgEPPP7UD2NJSb1DzPMVmNjtExsQO5vvE\n G+pgt+yz/F8k48ZBHLA1+bVOoja2j/8tq1aX13gWtuokCfkq1fKxyichR2CgvnvMk8o5\n BgmQ==;\n darn=vger.kernel.org"],"ARC-Authentication-Results":["i=2; smtp.subspace.kernel.org;\n dmarc=pass (p=none dis=none) header.from=asu.edu;\n spf=pass smtp.mailfrom=asu.edu;\n dkim=pass (2048-bit key) header.d=asu.edu header.i=@asu.edu\n header.b=AeX7psOB; arc=pass smtp.client-ip=209.85.215.180","i=1; mx.google.com; arc=none"],"DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=asu.edu; s=google; t=1776204046; x=1776808846; darn=vger.kernel.org;\n h=content-transfer-encoding:cc:to:subject:message-id:date:from\n :in-reply-to:references:mime-version:from:to:cc:subject:date\n :message-id:reply-to;\n bh=ceZIdMhLRnh9RyYVBOqFR3dRVpkiUcZi/iUWMzpGHAU=;\n b=AeX7psOBs9oSWp32P2E9/BTrfK+BOr7NQFN8oVGxb4+3nyENEVOtpFtS/+5chZShXA\n rG9KRpqVxUgeRg7AJ1ITbiAzKJTreagW6vJUu5J/PpNgFkyHv0uaaWDRJjVbJClhHCsZ\n A87xCoQ9ZMmlm4NSPVA+goWBWGCkC6e+scKTOSmGVwU2tjk5MnaMyEep0LYJtGCV+HyB\n sDs3rCVq7xnWEcWoNDF9uYVRW3xvvINEOUQk4yX5NtmIhBu5Jodsc5cVviKEBDwvedtL\n esqoWQ3jNWm0vrKiLr3oB5KkLwpEL6+skzo//htMcA3raSq7PztWS6sqVT469rNarSKK\n Jmyw==","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1776204046; x=1776808846;\n h=content-transfer-encoding:cc:to:subject:message-id:date:from\n :in-reply-to:references:mime-version:x-gm-gg:x-gm-message-state:from\n :to:cc:subject:date:message-id:reply-to;\n bh=ceZIdMhLRnh9RyYVBOqFR3dRVpkiUcZi/iUWMzpGHAU=;\n b=Ot2IQyCa2WmwfOXjP7n2JKMAObk4EJSJQ6I1sEDkcZo/7z+rtHhE+o3lWEqsC6FkIG\n Ko4APk80k/c/LeCjSygo4fzNxAvMCg9pIb6uHHmKFT9p5BDqoQriT4Qvo1IcPS5StYKc\n Jr6KBqLspj6doTx6CGnRpR45tfmh10DnOYamY848MBQCRrMKAGMRHTJ/yMs4nFwrH+yA\n LtyoMFBblkA8hCHDeUT5kDi+LjU00L2mCwmqcbIwZbLvo+YomlsOjKvZWjfyp/MeyNyp\n WuvfNBkJVH3gCR3gNeWbtUrCOXlS6ghL4bAslJ/oKn1IjWuiY7fp4hcpSzPJvxIxHUpY\n GmGw==","X-Forwarded-Encrypted":"i=1;\n AFNElJ8MnU7bRSU85LTarCmx+0gHNFY+A+9dRM8uD6Wr82/ga3MgyD3LeDoKsuzDJUtjEo0CwwLVQuZ9RRhq2Vtr5PE=@vger.kernel.org","X-Gm-Message-State":"AOJu0YzQvi8tTy204j/B0K3abXtqcAxBGJcTdl6Uwy4SnJNBf/8ki0E9\n\t78mcKPF3N/eVsZl6/pz2nExuIQMnAxhNdwsl37F2rO8sqP1GpBTXZ8oTccN1OD/E8nHvZMUnbJE\n\t/Uxrqj/eqOni/EcTL8y3a0eiKhvx/0qTRVbkUh2VF","X-Gm-Gg":"AeBDietMIaAsfC6lG9djm/dHYp/NOQTB7p9iFNojx0MJYqTqgvG99lVM+ZwTrhHkC6U\n\tBnQdBVUuCDVIByPnySFzvFmqRzJ7aHZ91nJ04e41mCOoKjnq8kiqBJhL4OVgbKiTPtYiqVJpjT1\n\tKPn/fhqs1Ba/EnKJjKEitWIOa+MvuLGIPnJ5SrLaJcTyjtQ2s6EuVQs9TPPyOnZloC8+VyqPU8g\n\tnUtWLMReGHZiVLGfyusYLLayFHcEQMSKdVhDGOLd1TXP+yx3f8IfO6VRnfds8cV5K+6oAnOtdR5\n\tqnH4G1iaRaS2+cPeT84=","X-Received":"by 2002:a17:903:3e0b:b0:2b2:4fc1:f653 with SMTP id\n d9443c01a7336-2b2d5c558e4mr102545865ad.3.1776204044111; Tue, 14 Apr 2026\n 15:00:44 -0700 (PDT)","Precedence":"bulk","X-Mailing-List":"netfilter-devel@vger.kernel.org","List-Id":"","List-Subscribe":"","List-Unsubscribe":"","MIME-Version":"1.0","References":"<20260410204843.64259-1-xmei5@asu.edu>\n \n ","In-Reply-To":"","From":"Xiang Mei ","Date":"Tue, 14 Apr 2026 15:00:33 -0700","X-Gm-Features":"AQROBzBNmkTJ5aONCXQbv7wnnx7YL38Ugi1nw1njGrXnKxdvKHBveiXpBC8ujMM","Message-ID":"\n ","Subject":"Re: [PATCH nf] netfilter: nfnetlink_osf: fix divide-by-zero in\n OSF_WSS_MODULO","To":"Florian Westphal ","Cc":"Pablo Neira Ayuso , netfilter-devel@vger.kernel.org,\n\tPhil Sutter , coreteam@netfilter.org,\n Weiming Shi ","Content-Type":"text/plain; charset=\"UTF-8\"","Content-Transfer-Encoding":"quoted-printable"}}]