Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/2223258/?format=api
{ "id": 2223258, "url": "http://patchwork.ozlabs.org/api/patches/2223258/?format=api", "web_url": "http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260414221401.2809350-1-xmei5@asu.edu/", "project": { "id": 26, "url": "http://patchwork.ozlabs.org/api/projects/26/?format=api", "name": "Netfilter Development", "link_name": "netfilter-devel", "list_id": "netfilter-devel.vger.kernel.org", "list_email": "netfilter-devel@vger.kernel.org", "web_url": null, "scm_url": null, "webscm_url": null, "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<20260414221401.2809350-1-xmei5@asu.edu>", "list_archive_url": null, "date": "2026-04-14T22:14:01", "name": "[nf,v2] netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO", "commit_ref": null, "pull_url": null, "state": "new", "archived": false, "hash": "e86eb5b7f50dfb83611738c26422db9076f63311", "submitter": { "id": 93033, "url": "http://patchwork.ozlabs.org/api/people/93033/?format=api", "name": "Xiang Mei", "email": "xmei5@asu.edu" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260414221401.2809350-1-xmei5@asu.edu/mbox/", "series": [ { "id": 499895, "url": "http://patchwork.ozlabs.org/api/series/499895/?format=api", "web_url": "http://patchwork.ozlabs.org/project/netfilter-devel/list/?series=499895", "date": "2026-04-14T22:14:01", "name": "[nf,v2] netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO", "version": 2, "mbox": "http://patchwork.ozlabs.org/series/499895/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2223258/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2223258/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "\n <netfilter-devel+bounces-11896-incoming=patchwork.ozlabs.org@vger.kernel.org>", "X-Original-To": [ "incoming@patchwork.ozlabs.org", "netfilter-devel@vger.kernel.org" ], "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=asu.edu header.i=@asu.edu header.a=rsa-sha256\n header.s=google header.b=qboAuy7t;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c04:e001:36c::12fc:5321; helo=tor.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-11896-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)", "smtp.subspace.kernel.org;\n\tdkim=pass (2048-bit key) header.d=asu.edu header.i=@asu.edu\n header.b=\"qboAuy7t\"", "smtp.subspace.kernel.org;\n arc=none smtp.client-ip=74.125.82.46", "smtp.subspace.kernel.org;\n dmarc=pass (p=none dis=none) header.from=asu.edu", "smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=asu.edu" ], "Received": [ "from tor.lore.kernel.org (tor.lore.kernel.org\n [IPv6:2600:3c04:e001:36c::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fwJTv6sQZz1yD5\n\tfor <incoming@patchwork.ozlabs.org>; Wed, 15 Apr 2026 08:14:27 +1000 (AEST)", "from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby tor.lore.kernel.org (Postfix) with ESMTP id 8ABDC307AACC\n\tfor <incoming@patchwork.ozlabs.org>; Tue, 14 Apr 2026 22:14:15 +0000 (UTC)", "from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id 8C4E838A715;\n\tTue, 14 Apr 2026 22:14:14 +0000 (UTC)", "from mail-dl1-f46.google.com (mail-dl1-f46.google.com\n [74.125.82.46])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id C9D7B389472\n\tfor <netfilter-devel@vger.kernel.org>; Tue, 14 Apr 2026 22:14:12 +0000 (UTC)", "by mail-dl1-f46.google.com with SMTP id\n a92af1059eb24-126ea4b77adso15187139c88.1\n for <netfilter-devel@vger.kernel.org>;\n Tue, 14 Apr 2026 15:14:12 -0700 (PDT)", "from p1.scai.dhcp.asu.edu (209-147-138-15.nat.asu.edu.\n [209.147.138.15])\n by smtp.gmail.com with ESMTPSA id\n a92af1059eb24-12c4b323428sm13517785c88.4.2026.04.14.15.14.10\n (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n Tue, 14 Apr 2026 15:14:11 -0700 (PDT)" ], "ARC-Seal": "i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1776204854; cv=none;\n b=NqYVKqUy8OBz0HBDc4CUZeCKoK6V0rYYxYGbmQWz+iAXnc7D9JFZzaRAa+Z2IwqY0fAxtVLXRRBAR2vSMN0k4xGzBrfAL11ng4KF6WhMtAeM6FhHSE/jjCffV28SiJDNVKW26Mx2W7zgamagGmXkd++oYyd060efJ8aAhzl8PNg=", "ARC-Message-Signature": "i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1776204854; c=relaxed/simple;\n\tbh=/CumOeAjJXXsmb/6L/suQapO1UW2/F8scULcYprsNlI=;\n\th=From:To:Cc:Subject:Date:Message-ID:MIME-Version;\n b=bCExhRF5TgiveryQsr4Mf4KKpqlg4dBRtSEOvLf8tP1hjSfFCN5+LdDLxg8ULCvLmVIbH25Aesp8/6MQiZu2hUy92wln+ik77V6/exfa8RPA196ZB8aFu2PS5JpFrRpZ0Vg/aGf0s12iHy3ywykaFNary+XfmVpM8VUJvnICX6M=", "ARC-Authentication-Results": "i=1; smtp.subspace.kernel.org;\n dmarc=pass (p=none dis=none) header.from=asu.edu;\n spf=pass smtp.mailfrom=asu.edu;\n dkim=pass (2048-bit key) header.d=asu.edu header.i=@asu.edu\n header.b=qboAuy7t; arc=none smtp.client-ip=74.125.82.46", "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=asu.edu; s=google; t=1776204852; x=1776809652; darn=vger.kernel.org;\n h=content-transfer-encoding:mime-version:message-id:date:subject:cc\n :to:from:from:to:cc:subject:date:message-id:reply-to;\n bh=/8oDk6Bv3/p8vkApYwMdU44Wt3x0ddwL222gIoY0s4w=;\n b=qboAuy7tnwO0jvVNjO9eA86rTj/BEHhJ3THfVZ6aLU60f7La0Jz3hU2XqV65z0v8Re\n l53Cp0PCtfRll7h0BeOUWkVx/u1ILtHG/D/sLAkC1XdYCp92l+iYTr3xE3pBwPpbBafM\n cPYzJnB/udl4meL4EMdqMtHdwHxNL30M8XlsK18BIe4mfbQILklY68yg2LqBg19ueYJ/\n 50qWpuS4wJOqgymQhvCgRnPlNAN5sStJtbVIgWQ7PzAefpAYWfrqWlI2C9DcDlzwyhcs\n pYIPqBUzsFg9y8rwnMVs4EsqYr9NNekeVIgGZ04tGRutOEQdPoKTXr2FxBpfJMZPHMCj\n ix8A==", "X-Google-DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1776204852; x=1776809652;\n h=content-transfer-encoding:mime-version:message-id:date:subject:cc\n :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date\n :message-id:reply-to;\n bh=/8oDk6Bv3/p8vkApYwMdU44Wt3x0ddwL222gIoY0s4w=;\n b=G6EnW+B3VzRYMX8JlFbG662q2JkR4wKv247DVA2xsa86M8tpdXC3zr2MNmm6H1ULKb\n Sgj2POEk73WroINBcnHQ5bRLZJU25lW7kAvwF6uD3BsnceEok1C/X3nYUqqfjZyU4ldb\n xPb0/0F/lYRkF0k5pDRAVjl0+UOUsE8qonabyjAlN0AQT80551Z1hvkF/FPufL8GhlLR\n AJioY5QsHnR4aPLpBsGIACkiUS7Z43fLItyJjYge6bsPQ5LhMedDywJ+eECe+bOZexfR\n cQ7EotfpaoOCDGkGLzmxfsltF1y7SZVaMmd1CK/IvVId1ETOyFiuSWZMWU6B9YCRcbPH\n kDuw==", "X-Gm-Message-State": "AOJu0Ywd0l89xkpOyZvV0iHOjUUzC9Kj2jCElXyJS64Y8XpiZ5l0v55W\n\tCNC/yDrT/+v6wGQFW2wrH1C1gDHwPY0Wu5tLLQYDnlHMkrxJ5QQtgkzUrHHlLRca/BhMTWj3cWZ\n\t1HKxJiw==", "X-Gm-Gg": "AeBDiesUb2Gypy9b+Y4K+jekjh83LpsJ1iYy485Hi5lA2/f3unTJUfJoYVkzwsZiRcw\n\txdgcX3/kjNplxJwBz+OJw1LNWyf/mBbyormYLhNeDFzABUsZpTr7U1YyzNUB8L9BS0+O/e7neM8\n\tQfI/4VypP+H5Bgjh9J4Ygrk6ULsaJhNGSWOytME7S7uc14hmgkZuZGYcdOjev2KfrkQ5ljCNFud\n\tzH4cwPcWzPrranYhazpEp0l9ajhnBJAcYSr5ILq8IupY02I8zS+vT6ykYaZm9mdE7BgXJq12DwG\n\tTm6VleqKYRpQvIlLFgPFvmvyRAJTzvVL3AbrDwUdJi+97JJwa8p31O6Qi+PLpk9GGRW/HRN56yI\n\tadWdRmPPpMCIEvsjm0xB7K06xxY6wyxeGcR3kRRYMZ0BbQv6nxE6Qc+L5vFRZ2D7k7uhN/roHKU\n\t5u4yo61nVVv4mIgxrK3B+24qvbhQLVLaJReCtpGRVs8kQVqGkEvEOjxQby7R3mcvys", "X-Received": "by 2002:a05:7022:6726:b0:119:e56c:18ae with SMTP id\n a92af1059eb24-12c34ede8e2mr10335876c88.22.1776204851535;\n Tue, 14 Apr 2026 15:14:11 -0700 (PDT)", "From": "Xiang Mei <xmei5@asu.edu>", "To": "netfilter-devel@vger.kernel.org", "Cc": "Pablo Neira Ayuso <pablo@netfilter.org>,\n\tFlorian Westphal <fw@strlen.de>,\n\tPhil Sutter <phil@nwl.cc>,\n\tcoreteam@netfilter.org,\n\tWeiming Shi <bestswngs@gmail.com>,\n\tXiang Mei <xmei5@asu.edu>", "Subject": "[PATCH nf v2] netfilter: nfnetlink_osf: fix divide-by-zero in\n OSF_WSS_MODULO", "Date": "Tue, 14 Apr 2026 15:14:01 -0700", "Message-ID": "<20260414221401.2809350-1-xmei5@asu.edu>", "X-Mailer": "git-send-email 2.43.0", "Precedence": "bulk", "X-Mailing-List": "netfilter-devel@vger.kernel.org", "List-Id": "<netfilter-devel.vger.kernel.org>", "List-Subscribe": "<mailto:netfilter-devel+subscribe@vger.kernel.org>", "List-Unsubscribe": "<mailto:netfilter-devel+unsubscribe@vger.kernel.org>", "MIME-Version": "1.0", "Content-Transfer-Encoding": "8bit" }, "content": "nf_osf_match_one() computes ctx->window % f->wss.val in the\nOSF_WSS_MODULO branch with no guard for f->wss.val == 0. A\nCAP_NET_ADMIN user can add such a fingerprint via nfnetlink; a\nsubsequent matching TCP SYN divides by zero and panics the kernel.\n\nReject the bogus fingerprint in nfnl_osf_add_callback() above the\nper-option for-loop. f->wss is per-fingerprint, not per-option, so\nthe check must run regardless of f->opt_num (including 0). Also\nreject wss.wc >= OSF_WSS_MAX; nf_osf_match_one() already treats that\nas \"should not happen\".\n\nCrash:\n Oops: divide error: 0000 [#1] SMP KASAN NOPTI\n RIP: 0010:nf_osf_match_one (net/netfilter/nfnetlink_osf.c:98)\n Call Trace:\n <IRQ>\n nf_osf_match (net/netfilter/nfnetlink_osf.c:220)\n xt_osf_match_packet (net/netfilter/xt_osf.c:32)\n ipt_do_table (net/ipv4/netfilter/ip_tables.c:348)\n nf_hook_slow (net/netfilter/core.c:622)\n ip_local_deliver (net/ipv4/ip_input.c:265)\n ip_rcv (include/linux/skbuff.h:1162)\n __netif_receive_skb_one_core (net/core/dev.c:6181)\n process_backlog (net/core/dev.c:6642)\n __napi_poll (net/core/dev.c:7710)\n net_rx_action (net/core/dev.c:7945)\n handle_softirqs (kernel/softirq.c:622)\n\nFixes: 11eeef41d5f6 (\"netfilter: passive OS fingerprint xtables match\")\nReported-by: Weiming Shi <bestswngs@gmail.com>\nSuggested-by: Florian Westphal <fw@strlen.de>\nSuggested-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Xiang Mei <xmei5@asu.edu>\n---\nv2: Fix the bug in configure path and correct the fix tag\n\n net/netfilter/nfnetlink_osf.c | 4 ++++\n 1 file changed, 4 insertions(+)", "diff": "diff --git a/net/netfilter/nfnetlink_osf.c b/net/netfilter/nfnetlink_osf.c\nindex 45d9ad231..70172ca07 100644\n--- a/net/netfilter/nfnetlink_osf.c\n+++ b/net/netfilter/nfnetlink_osf.c\n@@ -320,6 +320,10 @@ static int nfnl_osf_add_callback(struct sk_buff *skb,\n \tif (f->opt_num > ARRAY_SIZE(f->opt))\n \t\treturn -EINVAL;\n \n+\tif (f->wss.wc >= OSF_WSS_MAX ||\n+\t (f->wss.wc == OSF_WSS_MODULO && f->wss.val == 0))\n+\t\treturn -EINVAL;\n+\n \tfor (i = 0; i < f->opt_num; i++) {\n \t\tif (!f->opt[i].length || f->opt[i].length > MAX_IPOPTLEN)\n \t\t\treturn -EINVAL;\n", "prefixes": [ "nf", "v2" ] }