Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/2224570/?format=api
{ "id": 2224570, "url": "http://patchwork.ozlabs.org/api/patches/2224570/?format=api", "web_url": "http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260417162057.3732-2-fmancera@suse.de/", "project": { "id": 26, "url": "http://patchwork.ozlabs.org/api/projects/26/?format=api", "name": "Netfilter Development", "link_name": "netfilter-devel", "list_id": "netfilter-devel.vger.kernel.org", "list_email": "netfilter-devel@vger.kernel.org", "web_url": null, "scm_url": null, "webscm_url": null, "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<20260417162057.3732-2-fmancera@suse.de>", "list_archive_url": null, "date": "2026-04-17T16:20:57", "name": "[2/2,nf] netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check", "commit_ref": null, "pull_url": null, "state": "accepted", "archived": true, "hash": "e5fa1d10efeb14cf4233448b1e36dfba04299e41", "submitter": { "id": 90904, "url": "http://patchwork.ozlabs.org/api/people/90904/?format=api", "name": "Fernando Fernandez Mancera", "email": "fmancera@suse.de" }, "delegate": { "id": 11902, "url": "http://patchwork.ozlabs.org/api/users/11902/?format=api", "username": "strlen", "first_name": "Florian", "last_name": "Westphal", "email": "fw@strlen.de" }, "mbox": "http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260417162057.3732-2-fmancera@suse.de/mbox/", "series": [ { "id": 500370, "url": "http://patchwork.ozlabs.org/api/series/500370/?format=api", "web_url": "http://patchwork.ozlabs.org/project/netfilter-devel/list/?series=500370", "date": "2026-04-17T16:20:57", "name": "[1/2,nf] netfilter: nfnetlink_osf: fix out-of-bounds read on option matching", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/500370/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2224570/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2224570/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "\n <netfilter-devel+bounces-12003-incoming=patchwork.ozlabs.org@vger.kernel.org>", "X-Original-To": [ "incoming@patchwork.ozlabs.org", "netfilter-devel@vger.kernel.org" ], "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=pass (1024-bit key;\n unprotected) header.d=suse.de header.i=@suse.de header.a=rsa-sha256\n header.s=susede2_rsa header.b=TDUO9Koh;\n\tdkim=pass header.d=suse.de header.i=@suse.de header.a=ed25519-sha256\n header.s=susede2_ed25519 header.b=LZeRX3OI;\n\tdkim=pass (1024-bit key) header.d=suse.de header.i=@suse.de\n header.a=rsa-sha256 header.s=susede2_rsa header.b=ZN23vV+i;\n\tdkim=neutral header.d=suse.de header.i=@suse.de header.a=ed25519-sha256\n header.s=susede2_ed25519 header.b=aZb2fu9A;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c09:e001:a7::12fc:5321; helo=sto.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-12003-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)", "smtp.subspace.kernel.org;\n\tdkim=pass (1024-bit key) header.d=suse.de header.i=@suse.de\n header.b=\"TDUO9Koh\";\n\tdkim=permerror (0-bit key) header.d=suse.de header.i=@suse.de\n header.b=\"LZeRX3OI\";\n\tdkim=pass (1024-bit key) header.d=suse.de header.i=@suse.de\n header.b=\"ZN23vV+i\";\n\tdkim=permerror (0-bit key) header.d=suse.de header.i=@suse.de\n header.b=\"aZb2fu9A\"", "smtp.subspace.kernel.org;\n arc=none smtp.client-ip=195.135.223.131", "smtp.subspace.kernel.org;\n dmarc=pass (p=none dis=none) header.from=suse.de", "smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=suse.de", "smtp-out2.suse.de;\n\tnone" ], "Received": [ "from sto.lore.kernel.org (sto.lore.kernel.org\n [IPv6:2600:3c09:e001:a7::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fy0Z66XYzz1yDF\n\tfor <incoming@patchwork.ozlabs.org>; Sat, 18 Apr 2026 02:23:58 +1000 (AEST)", "from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sto.lore.kernel.org (Postfix) with ESMTP id 9F2673073090\n\tfor <incoming@patchwork.ozlabs.org>; Fri, 17 Apr 2026 16:22:12 +0000 (UTC)", "from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id 00CB2354ACE;\n\tFri, 17 Apr 2026 16:21:57 +0000 (UTC)", "from smtp-out2.suse.de (smtp-out2.suse.de [195.135.223.131])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id 1F2A3351C14\n\tfor <netfilter-devel@vger.kernel.org>; Fri, 17 Apr 2026 16:21:54 +0000 (UTC)", "from imap1.dmz-prg2.suse.org (unknown [10.150.64.97])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest\n SHA256)\n\t(No client certificate requested)\n\tby smtp-out2.suse.de (Postfix) with ESMTPS id 2D3B85BD6A;\n\tFri, 17 Apr 2026 16:21:45 +0000 (UTC)", "from imap1.dmz-prg2.suse.org (localhost [127.0.0.1])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest\n SHA256)\n\t(No client certificate requested)\n\tby imap1.dmz-prg2.suse.org (Postfix) with ESMTPS id AA224593AE;\n\tFri, 17 Apr 2026 16:21:44 +0000 (UTC)", "from dovecot-director2.suse.de ([2a07:de40:b281:106:10:150:64:167])\n\tby imap1.dmz-prg2.suse.org with ESMTPSA\n\tid cGLFJhhe4mlAFQAAD6G6ig\n\t(envelope-from <fmancera@suse.de>); Fri, 17 Apr 2026 16:21:44 +0000" ], "ARC-Seal": "i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1776442916; cv=none;\n b=D2DOQX+CB6RzPqE7lPByF8ROEpulSzm3WRJMbtwgtsW0iVqWyXljZ0KKV3052c3oQRWWVYu5fJtenm7q2PPlfGeP5InfsVmc0gwUnN3tGkmDiYUkkFgK6GIEq2LJR2HjlsJr5qAp6C3GmKhGNI5/ifvSLJnt8l19aO4X0QNPqmU=", "ARC-Message-Signature": "i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1776442916; c=relaxed/simple;\n\tbh=hS+9/c0wkyuDAsKloIIceu/S6QTx+mwr25Zziy7MZOA=;\n\th=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:\n\t MIME-Version;\n b=jWyiqwfWwus4gbbTD/Pn9R8wBGr4/GIq+tgRUrzq2drD7Dk2D86BlBnw4nXR7MNTkVOM8v046+qF0cvgu1Sy257f/gmMNm26BwjrumzVmwpv+mVuebgVkZNgrIfo99BvciyuWvEyiar6D7gvacKj8yv16zOsU/of0ilVq13xOiE=", "ARC-Authentication-Results": "i=1; smtp.subspace.kernel.org;\n dmarc=pass (p=none dis=none) header.from=suse.de;\n spf=pass smtp.mailfrom=suse.de;\n dkim=pass (1024-bit key) header.d=suse.de header.i=@suse.de\n header.b=TDUO9Koh;\n dkim=permerror (0-bit key) header.d=suse.de header.i=@suse.de\n header.b=LZeRX3OI;\n dkim=pass (1024-bit key) header.d=suse.de header.i=@suse.de\n header.b=ZN23vV+i;\n dkim=permerror (0-bit key) header.d=suse.de header.i=@suse.de\n header.b=aZb2fu9A; arc=none smtp.client-ip=195.135.223.131", "DKIM-Signature": [ "v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.de;\n s=susede2_rsa;\n\tt=1776442909;\n h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc:\n\t mime-version:mime-version:\n\t content-transfer-encoding:content-transfer-encoding:\n\t in-reply-to:in-reply-to:references:references;\n\tbh=QRgpWyM7ORPv84VXfXpsGgufMh6mX8Pkm5cLRpDYg5A=;\n\tb=TDUO9KohXAuFprlLyGR518y4nVbUcscrr4HMCcMzDauSYYEcyy69yHxkj3cnSJikgjVDz6\n\tXh7PhfPbGfDPIz4F297cbv19HZZasyyyXZ4+Bl1aneF5oEdUAAGoMHoga5HSoj0ovOXzwN\n\tTTUFOCNuoc9VhuP69bealO/hGsBLxfY=", "v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.de;\n\ts=susede2_ed25519; t=1776442909;\n\th=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc:\n\t mime-version:mime-version:\n\t content-transfer-encoding:content-transfer-encoding:\n\t in-reply-to:in-reply-to:references:references;\n\tbh=QRgpWyM7ORPv84VXfXpsGgufMh6mX8Pkm5cLRpDYg5A=;\n\tb=LZeRX3OIlAWHCWy61BrWt3otkh/R3y9tUH7zmtMc3LwfIxRPJWmYZKN4iW4txRjRqs2nCY\n\td+l9wJ2zU6cO7lBQ==", "v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.de;\n s=susede2_rsa;\n\tt=1776442905;\n h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc:\n\t mime-version:mime-version:\n\t content-transfer-encoding:content-transfer-encoding:\n\t in-reply-to:in-reply-to:references:references;\n\tbh=QRgpWyM7ORPv84VXfXpsGgufMh6mX8Pkm5cLRpDYg5A=;\n\tb=ZN23vV+iwzefUsQNBhtwWyRBEr94g6muDEdOofwYqUZaXJAHo+3XwCfUo23l2AcgPBb0cH\n\tU1g827cPCUQJWunjfwaYVX80eL9U7Z8h17wU0rYR/q8Ilx0y8fVeOCrRnKOHTqsgWCIl4u\n\tow0dix8uzVoxnIFoi2wAxZcR5YiGC/E=", "v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.de;\n\ts=susede2_ed25519; t=1776442905;\n\th=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc:\n\t mime-version:mime-version:\n\t content-transfer-encoding:content-transfer-encoding:\n\t in-reply-to:in-reply-to:references:references;\n\tbh=QRgpWyM7ORPv84VXfXpsGgufMh6mX8Pkm5cLRpDYg5A=;\n\tb=aZb2fu9A2MaDqWMhx4AhcQK9Eu/nZp7eUKODHI0kqC+cJEAeg4vZav2ZG5dGGZLQiBoPIv\n\tOR0iVfWI1+s2LZBw==" ], "From": "Fernando Fernandez Mancera <fmancera@suse.de>", "To": "netfilter-devel@vger.kernel.org", "Cc": "netdev@vger.kernel.org,\n\tcoreteam@netfilter.org,\n\tpablo@netfilter.org,\n\tfw@strlen.de,\n\tphil@nwl.cc,\n\tFernando Fernandez Mancera <fmancera@suse.de>,\n\t\"Kito Xu (veritas501)\" <hxzene@gmail.com>", "Subject": "[PATCH 2/2 nf] netfilter: nfnetlink_osf: fix potential NULL\n dereference in ttl check", "Date": "Fri, 17 Apr 2026 18:20:57 +0200", "Message-ID": "<20260417162057.3732-2-fmancera@suse.de>", "X-Mailer": "git-send-email 2.51.0", "In-Reply-To": "<20260417162057.3732-1-fmancera@suse.de>", "References": "<20260417162057.3732-1-fmancera@suse.de>", "Precedence": "bulk", "X-Mailing-List": "netfilter-devel@vger.kernel.org", "List-Id": "<netfilter-devel.vger.kernel.org>", "List-Subscribe": "<mailto:netfilter-devel+subscribe@vger.kernel.org>", "List-Unsubscribe": "<mailto:netfilter-devel+unsubscribe@vger.kernel.org>", "MIME-Version": "1.0", "Content-Transfer-Encoding": "8bit", "X-Spamd-Result": "default: False [-6.80 / 50.00];\n\tREPLY(-4.00)[];\n\tBAYES_HAM(-3.00)[100.00%];\n\tMID_CONTAINS_FROM(1.00)[];\n\tNEURAL_HAM_LONG(-1.00)[-1.000];\n\tR_MISSING_CHARSET(0.50)[];\n\tNEURAL_HAM_SHORT(-0.20)[-1.000];\n\tMIME_GOOD(-0.10)[text/plain];\n\tRCVD_COUNT_TWO(0.00)[2];\n\tRCVD_VIA_SMTP_AUTH(0.00)[];\n\tFROM_HAS_DN(0.00)[];\n\tARC_NA(0.00)[];\n\tMIME_TRACE(0.00)[0:+];\n\tFREEMAIL_CC(0.00)[vger.kernel.org,netfilter.org,strlen.de,nwl.cc,suse.de,gmail.com];\n\tTO_MATCH_ENVRCPT_ALL(0.00)[];\n\tFROM_EQ_ENVFROM(0.00)[];\n\tRCPT_COUNT_SEVEN(0.00)[8];\n\tDBL_BLOCKED_OPENRESOLVER(0.00)[imap1.dmz-prg2.suse.org:helo,suse.de:mid,suse.de:email];\n\tRCVD_TLS_ALL(0.00)[];\n\tDKIM_SIGNED(0.00)[suse.de:s=susede2_rsa,suse.de:s=susede2_ed25519];\n\tTO_DN_SOME(0.00)[];\n\tFREEMAIL_ENVRCPT(0.00)[gmail.com]", "X-Spam-Flag": "NO", "X-Spam-Score": "-6.80", "X-Spam-Level": "" }, "content": "The nf_osf_ttl() function accessed skb->dev to perform a local interface\naddress lookup without verifying that the device pointer was valid.\n\nAdditionally, the implementation utilized an in_dev_for_each_ifa_rcu\nloop to match the packet source address against local interface\naddresses. It assumed that packets from the same subnet should not see a\ndecrement on the initial TTL. A packet might appear it is from the same\nsubnet but it actually isn't especially in modern environments with\ncontainers and virtual switching.\n\nRemove the device dereference and interface loop. Replace the logic with\na switch statement that evaluates the TTL according to the ttl_check.\n\nFixes: 11eeef41d5f6 (\"netfilter: passive OS fingerprint xtables match\")\nReported-by: Kito Xu (veritas501) <hxzene@gmail.com>\nCloses: https://lore.kernel.org/netfilter-devel/20260414074556.2512750-1-hxzene@gmail.com/\nSigned-off-by: Fernando Fernandez Mancera <fmancera@suse.de>\n---\nNote: if some help is needed during the backport I can assist.\n---\n net/netfilter/nfnetlink_osf.c | 22 +++++++---------------\n 1 file changed, 7 insertions(+), 15 deletions(-)", "diff": "diff --git a/net/netfilter/nfnetlink_osf.c b/net/netfilter/nfnetlink_osf.c\nindex f58267986453..f0d1e596e146 100644\n--- a/net/netfilter/nfnetlink_osf.c\n+++ b/net/netfilter/nfnetlink_osf.c\n@@ -31,26 +31,18 @@ EXPORT_SYMBOL_GPL(nf_osf_fingers);\n static inline int nf_osf_ttl(const struct sk_buff *skb,\n \t\t\t int ttl_check, unsigned char f_ttl)\n {\n-\tstruct in_device *in_dev = __in_dev_get_rcu(skb->dev);\n \tconst struct iphdr *ip = ip_hdr(skb);\n-\tconst struct in_ifaddr *ifa;\n-\tint ret = 0;\n \n-\tif (ttl_check == NF_OSF_TTL_TRUE)\n+\tswitch (ttl_check) {\n+\tcase NF_OSF_TTL_TRUE:\n \t\treturn ip->ttl == f_ttl;\n-\tif (ttl_check == NF_OSF_TTL_NOCHECK)\n-\t\treturn 1;\n-\telse if (ip->ttl <= f_ttl)\n+\t\tbreak;\n+\tcase NF_OSF_TTL_NOCHECK:\n \t\treturn 1;\n-\n-\tin_dev_for_each_ifa_rcu(ifa, in_dev) {\n-\t\tif (inet_ifa_match(ip->saddr, ifa)) {\n-\t\t\tret = (ip->ttl == f_ttl);\n-\t\t\tbreak;\n-\t\t}\n+\tcase NF_OSF_TTL_LESS:\n+\tdefault:\n+\t\treturn ip->ttl <= f_ttl;\n \t}\n-\n-\treturn ret;\n }\n \n struct nf_osf_hdr_ctx {\n", "prefixes": [ "2/2", "nf" ] }