Patch Detail

HTTP 200 OK
Allow: GET, PUT, PATCH, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept

{
    "id": 2224440,
    "url": "http://patchwork.ozlabs.org/api/patches/2224440/?format=api",
    "web_url": "http://patchwork.ozlabs.org/project/netfilter-devel/patch/85a95e0ef783ed8f5f4a787138cca22f995d8056.1776141503.git.wangjiexun2025@gmail.com/",
    "project": {
        "id": 26,
        "url": "http://patchwork.ozlabs.org/api/projects/26/?format=api",
        "name": "Netfilter Development",
        "link_name": "netfilter-devel",
        "list_id": "netfilter-devel.vger.kernel.org",
        "list_email": "netfilter-devel@vger.kernel.org",
        "web_url": null,
        "scm_url": null,
        "webscm_url": null,
        "list_archive_url": "",
        "list_archive_url_format": "",
        "commit_url_format": ""
    },
    "msgid": "<85a95e0ef783ed8f5f4a787138cca22f995d8056.1776141503.git.wangjiexun2025@gmail.com>",
    "list_archive_url": null,
    "date": "2026-04-17T12:25:06",
    "name": "[nf,1/1] netfilter: xt_policy: fix strict mode inbound policy matching",
    "commit_ref": null,
    "pull_url": null,
    "state": "new",
    "archived": false,
    "hash": "ccb09e96be13fd14e5477768d79b89fb83afa902",
    "submitter": {
        "id": 92912,
        "url": "http://patchwork.ozlabs.org/api/people/92912/?format=api",
        "name": "Ren Wei",
        "email": "n05ec@lzu.edu.cn"
    },
    "delegate": null,
    "mbox": "http://patchwork.ozlabs.org/project/netfilter-devel/patch/85a95e0ef783ed8f5f4a787138cca22f995d8056.1776141503.git.wangjiexun2025@gmail.com/mbox/",
    "series": [
        {
            "id": 500322,
            "url": "http://patchwork.ozlabs.org/api/series/500322/?format=api",
            "web_url": "http://patchwork.ozlabs.org/project/netfilter-devel/list/?series=500322",
            "date": "2026-04-17T12:25:06",
            "name": "[nf,1/1] netfilter: xt_policy: fix strict mode inbound policy matching",
            "version": 1,
            "mbox": "http://patchwork.ozlabs.org/series/500322/mbox/"
        }
    ],
    "comments": "http://patchwork.ozlabs.org/api/patches/2224440/comments/",
    "check": "pending",
    "checks": "http://patchwork.ozlabs.org/api/patches/2224440/checks/",
    "tags": {},
    "related": [],
    "headers": {
        "Return-Path": "\n <netfilter-devel+bounces-11999-incoming=patchwork.ozlabs.org@vger.kernel.org>",
        "X-Original-To": [
            "incoming@patchwork.ozlabs.org",
            "netfilter-devel@vger.kernel.org"
        ],
        "Delivered-To": "patchwork-incoming@legolas.ozlabs.org",
        "Authentication-Results": [
            "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=172.105.105.114; helo=tor.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-11999-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)",
            "smtp.subspace.kernel.org;\n arc=none smtp.client-ip=4.193.249.245",
            "smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=lzu.edu.cn",
            "smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=lzu.edu.cn"
        ],
        "Received": [
            "from tor.lore.kernel.org (tor.lore.kernel.org [172.105.105.114])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fxvMl1yBpz1yD3\n\tfor <incoming@patchwork.ozlabs.org>; Fri, 17 Apr 2026 22:29:39 +1000 (AEST)",
            "from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby tor.lore.kernel.org (Postfix) with ESMTP id D69A13021980\n\tfor <incoming@patchwork.ozlabs.org>; Fri, 17 Apr 2026 12:29:20 +0000 (UTC)",
            "from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id D5792396572;\n\tFri, 17 Apr 2026 12:29:17 +0000 (UTC)",
            "from azure-sdnproxy.icoremail.net (azure-sdnproxy.icoremail.net\n [4.193.249.245])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id 5C6263859EB\n\tfor <netfilter-devel@vger.kernel.org>; Fri, 17 Apr 2026 12:29:11 +0000 (UTC)",
            "from enjou-Legion-Y7000P-2019.coin-barley.ts.net (unknown\n [172.23.56.36])\n\tby app1 (Coremail) with SMTP id ygmowACH+_tyJ+Jp5CbQAA--.13061S3;\n\tFri, 17 Apr 2026 20:28:36 +0800 (CST)"
        ],
        "ARC-Seal": "i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1776428957; cv=none;\n b=Y+02KVwfqaA8rnbpwcXQcdJ5l2jNaXMFuCkiqopjoQRFpK4JgjqTMXHKs2/5PVjUGlJy/xbtR/YZKyZkbXxqnrG62FBoZYUEwSbbUXr7I2uE/Sjjwczl/+cjxFd5lNF3dJpN8qOcQbXdH2DYGd6norgxVLyGjydHeuqpy6cjif0=",
        "ARC-Message-Signature": "i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1776428957; c=relaxed/simple;\n\tbh=AU7vos6dF+irj8p6nzJ2xeKoza49aDZZtbTNmr0J/pI=;\n\th=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:\n\t MIME-Version;\n b=mtZ09Y10TzuLcF1rWGMYUTwm+1CmNHBXdUIXOlv/RFGg2Bc8IgHYMbGZtXhR9NEbkRzkU9vLNpttYgZ0mo7++r2frXUdGNi4yy6L4VMlbbdPJ30TyAMQEb7ii+O6QvtLHmdioE5Th5/XaFKSUxLKfoioP+3nthC5aEcrNT020A4=",
        "ARC-Authentication-Results": "i=1; smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=lzu.edu.cn;\n spf=pass smtp.mailfrom=lzu.edu.cn; arc=none smtp.client-ip=4.193.249.245",
        "From": "Ren Wei <n05ec@lzu.edu.cn>",
        "To": "netfilter-devel@vger.kernel.org",
        "Cc": "pablo@netfilter.org,\n\tfw@strlen.de,\n\tphil@nwl.cc,\n\tdavem@davemloft.net,\n\tedumazet@google.com,\n\tkuba@kernel.org,\n\tpabeni@redhat.com,\n\thorms@kernel.org,\n\tebiederm@xmission.com,\n\tyuantan098@gmail.com,\n\tyifanwucs@gmail.com,\n\ttomapufckgml@gmail.com,\n\tbird@lzu.edu.cn,\n\twangjiexun2025@gmail.com,\n\tn05ec@lzu.edu.cn",
        "Subject": "[PATCH nf 1/1] netfilter: xt_policy: fix strict mode inbound policy\n matching",
        "Date": "Fri, 17 Apr 2026 20:25:06 +0800",
        "Message-ID": "\n <85a95e0ef783ed8f5f4a787138cca22f995d8056.1776141503.git.wangjiexun2025@gmail.com>",
        "X-Mailer": "git-send-email 2.51.0",
        "In-Reply-To": "<cover.1776141503.git.wangjiexun2025@gmail.com>",
        "References": "<cover.1776141503.git.wangjiexun2025@gmail.com>",
        "Precedence": "bulk",
        "X-Mailing-List": "netfilter-devel@vger.kernel.org",
        "List-Id": "<netfilter-devel.vger.kernel.org>",
        "List-Subscribe": "<mailto:netfilter-devel+subscribe@vger.kernel.org>",
        "List-Unsubscribe": "<mailto:netfilter-devel+unsubscribe@vger.kernel.org>",
        "MIME-Version": "1.0",
        "Content-Transfer-Encoding": "8bit",
        "X-CM-TRANSID": "ygmowACH+_tyJ+Jp5CbQAA--.13061S3",
        "X-Coremail-Antispam": "1UD129KBjvJXoW7uw1DZF4DWry3CFW3GFy8Xwb_yoW8GrWrpF\n\tZxK34DCryDXry5JwnrGryxuFWUAFykCw4xArZ8K3s7Z3s7Jr1UGa1rKrW2vFn8AF1qgr4Y\n\tvF4q93sYk3Z8ArJanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2\n\t9KBjDU0xBIdaVrnRJUUUB01xkIjI8I6I8E6xAIw20EY4v20xvaj40_Wr0E3s1l1IIY67AE\n\tw4v_Jr0_Jr4l8cAvFVAK0II2c7xJM28CjxkF64kEwVA0rcxSw2x7M28EF7xvwVC0I7IYx2\n\tIY67AKxVW5JVW7JwA2z4x0Y4vE2Ix0cI8IcVCY1x0267AKxVWxJVW8Jr1l84ACjcxK6I8E\n\t87Iv67AKxVW0oVCq3wA2z4x0Y4vEx4A2jsIEc7CjxVAFwI0_GcCE3s1le2I262IYc4CY6c\n\t8Ij28IcVAaY2xG8wAqx4xG64xvF2IEw4CE5I8CrVC2j2WlYx0E2Ix0cI8IcVAFwI0_Jr0_\n\tJr4lYx0Ex4A2jsIE14v26r1j6r4UMcvjeVCFs4IE7xkEbVWUJVW8JwACjcxG0xvY0x0EwI\n\txGrwACjI8F5VA0II8E6IAqYI8I648v4I1lFIxGxcIEc7CjxVA2Y2ka0xkIwI1lc7CjxVAa\n\tw2AFwI0_Jw0_GFylc2xSY4AK6svPMxAIw28IcxkI7VAKI48JMxAIw28IcVCjz48v1sIEY2\n\t0_Gr4l4I8I3I0E4IkC6x0Yz7v_Jr0_Gr1lx2IqxVAqx4xG67AKxVWUJVWUGwC20s026x8G\n\tjcxK67AKxVWUGVWUWwC2zVAF1VAY17CE14v26r4a6rW5MIIYrxkI7VAKI48JMIIF0xvE2I\n\tx0cI8IcVAFwI0_Jr0_JF4lIxAIcVC0I7IYx2IY6xkF7I0E14v26r4j6F4UMIIF0xvE42xK\n\t8VAvwI8IcIk0rVWUJVWUCwCI42IY6I8E87Iv67AKxVWUJVW8JwCI42IY6I8E87Iv6xkF7I\n\t0E14v26r4j6r4UJbIYCTnIWIevJa73UjIFyTuYvjfUonmRUUUUU",
        "X-CM-SenderInfo": "zqqvvuo6o23hxhgxhubq/1tbiAQEACWnh8+AE7gAAs4"
    },
    "content": "From: Jiexun Wang <wangjiexun2025@gmail.com>\n\nmatch_policy_in() walks sec_path entries from the last transform to the\nfirst one, but strict policy matching needs to consume info->pol[] in\nthe same forward order as the rule layout.\n\nDerive the strict-match policy position from the number of transforms\nalready consumed so that multi-element inbound rules are matched\nconsistently.\n\nFixes: df008c91f835 (\"net: Allow userns root to control llc, netfilter, netlink, packet, and xfrm\")\nCc: stable@kernel.org\nReported-by: Yuan Tan <yuantan098@gmail.com>\nReported-by: Yifan Wu <yifanwucs@gmail.com>\nReported-by: Juefei Pu <tomapufckgml@gmail.com>\nReported-by: Xin Liu <bird@lzu.edu.cn>\nSigned-off-by: Jiexun Wang <wangjiexun2025@gmail.com>\nSigned-off-by: Ren Wei <n05ec@lzu.edu.cn>\n---\n net/netfilter/xt_policy.c | 2 +-\n 1 file changed, 1 insertion(+), 1 deletion(-)",
    "diff": "diff --git a/net/netfilter/xt_policy.c b/net/netfilter/xt_policy.c\nindex cb6e8279010a..b5fa65558318 100644\n--- a/net/netfilter/xt_policy.c\n+++ b/net/netfilter/xt_policy.c\n@@ -63,7 +63,7 @@ match_policy_in(const struct sk_buff *skb, const struct xt_policy_info *info,\n \t\treturn 0;\n \n \tfor (i = sp->len - 1; i >= 0; i--) {\n-\t\tpos = strict ? i - sp->len + 1 : 0;\n+\t\tpos = strict ? sp->len - i - 1 : 0;\n \t\tif (pos >= info->len)\n \t\t\treturn 0;\n \t\te = &info->pol[pos];\n",
    "prefixes": [
        "nf",
        "1/1"
    ]
}