[{"id":3680049,"web_url":"http://patchwork.ozlabs.org/comment/3680049/","msgid":"<20260421194951.GA1976704@celephais.dreamlands>","list_archive_url":null,"date":"2026-04-21T19:49:51","subject":"Re: [PATCH nf] netfilter: nft_bitwise: fix dst corruption in same\n register shifts","submitter":{"id":76155,"url":"http://patchwork.ozlabs.org/api/people/76155/","name":"Jeremy Sowden","email":"jeremy@azazel.net"},"content":"On 2026-04-21, at 19:38:52 +0200, Fernando Fernandez Mancera wrote:\n> For lshift and rshift, the shift operations are performed in a loop over\n> 32-bit words. The loop calculates the shifted value and write it to dst,\n> and then immediately reads from src to calculate the carry for the next\n> iteration. Because src and dst could point to the same memory location,\n> the carry is incorrectly calculated using the newly modified dst value\n> instead of the original src value.\n> \n> Adding a temporal local variable to cache the original value before\n            ^^^^^^^^\n\n\"Temporary\"?\n\n> writing to dst and using it for the carry calculation solves the\n> problem. This was tested with the following payload:\n> \n> table test_table ip flags 0 use 1 handle 1\n> ip test_table test_chain use 3 type filter hook input prio 0 policy accept packets 0 bytes 0 flags 1\n> ip test_table test_chain 2\n>   [ immediate reg 1 0x44332211 0x88776655 ]\n>   [ bitwise reg 1 = ( reg 1 << 0x08000000 ) ]\n>   [ cmp eq reg 1 0x66443322 0x00887766 ]\n>   [ counter pkts 0 bytes 0 ]\n> ip test_table test_chain 4 3\n>   [ immediate reg 1 0x44332211 0x88776655 ]\n>   [ bitwise reg 1 = ( reg 1 << 0x08000000 ) ]\n>   [ cmp eq reg 1 0x55443322 0x00887766 ]\n>   [ counter pkts 21794 bytes 1917798 ]\n> \n> Fixes: 567d746b55bc (\"netfilter: bitwise: add support for shifts.\")\n> Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>\n\nAcked-By: Jeremy Sowden <jeremy@azazel.net>\n\n> ---\n> Note: I found this issue while digging into the lshift/rshift operation\n> ---\n>  net/netfilter/nft_bitwise.c | 12 ++++++++----\n>  1 file changed, 8 insertions(+), 4 deletions(-)\n> \n> diff --git a/net/netfilter/nft_bitwise.c b/net/netfilter/nft_bitwise.c\n> index 13808e9cd999..136e8f3a71c5 100644\n> --- a/net/netfilter/nft_bitwise.c\n> +++ b/net/netfilter/nft_bitwise.c\n> @@ -43,8 +43,10 @@ static void nft_bitwise_eval_lshift(u32 *dst, const u32 *src,\n>  \tu32 carry = 0;\n> \n>  \tfor (i = DIV_ROUND_UP(priv->len, sizeof(u32)); i > 0; i--) {\n> -\t\tdst[i - 1] = (src[i - 1] << shift) | carry;\n> -\t\tcarry = src[i - 1] >> (BITS_PER_TYPE(u32) - shift);\n> +\t\tu32 tmp_src = src[i - 1];\n> +\n> +\t\tdst[i - 1] = (tmp_src << shift) | carry;\n> +\t\tcarry = tmp_src >> (BITS_PER_TYPE(u32) - shift);\n>  \t}\n>  }\n> \n> @@ -56,8 +58,10 @@ static void nft_bitwise_eval_rshift(u32 *dst, const u32 *src,\n>  \tu32 carry = 0;\n> \n>  \tfor (i = 0; i < DIV_ROUND_UP(priv->len, sizeof(u32)); i++) {\n> -\t\tdst[i] = carry | (src[i] >> shift);\n> -\t\tcarry = src[i] << (BITS_PER_TYPE(u32) - shift);\n> +\t\tu32 tmp_src = src[i];\n> +\n> +\t\tdst[i] = carry | (tmp_src >> shift);\n> +\t\tcarry = tmp_src << (BITS_PER_TYPE(u32) - shift);\n>  \t}\n>  }\n> \n> -- \n> 2.53.0\n>","headers":{"Return-Path":"\n <netfilter-devel+bounces-12121-incoming=patchwork.ozlabs.org@vger.kernel.org>","X-Original-To":["incoming@patchwork.ozlabs.org","netfilter-devel@vger.kernel.org"],"Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=fail reason=\"signature verification failed\" (2048-bit key;\n secure) header.d=azazel.net header.i=@azazel.net header.a=rsa-sha256\n header.s=20220717 header.b=WUyWK46u;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=172.234.253.10; helo=sea.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-12121-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)","smtp.subspace.kernel.org;\n\tdkim=fail reason=\"signature verification failed\" (2048-bit key)\n header.d=azazel.net header.i=@azazel.net header.b=\"WUyWK46u\"","smtp.subspace.kernel.org;\n arc=none smtp.client-ip=35.176.194.208","smtp.subspace.kernel.org;\n dmarc=pass (p=none dis=none) header.from=azazel.net","smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=azazel.net"],"Received":["from sea.lore.kernel.org (sea.lore.kernel.org [172.234.253.10])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g0YVW0BkMz1yHB\n\tfor <incoming@patchwork.ozlabs.org>; Wed, 22 Apr 2026 06:14:43 +1000 (AEST)","from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sea.lore.kernel.org (Postfix) with ESMTP id 6788330F2358\n\tfor <incoming@patchwork.ozlabs.org>; Tue, 21 Apr 2026 20:08:12 +0000 (UTC)","from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id EF64F3DCDB5;\n\tTue, 21 Apr 2026 20:08:11 +0000 (UTC)","from azazel.net (taras.nevrast.org [35.176.194.208])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id 3A63B382391\n\tfor <netfilter-devel@vger.kernel.org>; Tue, 21 Apr 2026 20:08:08 +0000 (UTC)","from celephais.dreamlands.azazel.net\n ([2001:8b0:fb7d:d6d7:3c21:9cff:fe2f:35f] helo=celephais.dreamlands)\n\tby taras.nevrast.org with esmtpsa  (TLS1.3) tls\n TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384\n\t(Exim 4.98.2)\n\t(envelope-from <jeremy@azazel.net>)\n\tid 1wFH6W-00000009lyL-0YCc;\n\tTue, 21 Apr 2026 20:49:52 +0100"],"ARC-Seal":"i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1776802091; cv=none;\n b=rxNRVVtsRQtkgD7j3ZNDOZpmCF7b6uTk0pdQyc1frSs4maBAUXAB0Wesq0M29IbOBt8qMkyosQbJzpnZIjY+Hd0Lrj1YFijy1nsQ3BLd7M39x9+zQ+hHv+j1rc4YtGlSjEc4OA65AWWQTg5n3jtVEFnbNPi8BRc5yijmSG+S3jg=","ARC-Message-Signature":"i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1776802091; c=relaxed/simple;\n\tbh=8xHF7dEWH8gC5oOu5fMiPUOBUmcx/65H1uNj0Vfvgho=;\n\th=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version:\n\t Content-Type:Content-Disposition:In-Reply-To;\n b=NFOwG+5/1i+kviaE9vcsb6Ezbro89TQsJOh1GnlkloWWIobnCwLhWtqF69eLULtMUjBENBlb4EHIzHiozLRbOlexionerIhdaVX292iuxby3Urrjce2VMzSb/OgaIf/ParDbfWNupId0i1PpEF7lDNw71bJ3vCFMQKBGqMfJHwM=","ARC-Authentication-Results":"i=1; smtp.subspace.kernel.org;\n dmarc=pass (p=none dis=none) header.from=azazel.net;\n spf=pass smtp.mailfrom=azazel.net;\n dkim=pass (2048-bit key) header.d=azazel.net header.i=@azazel.net\n header.b=WUyWK46u; arc=none smtp.client-ip=35.176.194.208","DKIM-Signature":"v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=azazel.net;\n\ts=20220717; h=In-Reply-To:Content-Type:MIME-Version:References:Message-ID:\n\tSubject:Cc:To:From:Date:Sender:Reply-To:Content-Transfer-Encoding:Content-ID:\n\tContent-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc\n\t:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe:\n\tList-Post:List-Owner:List-Archive;\n\tbh=I4kHa3T2sQxFZGqNFgsyL+g/Ld8nU+akMCOuCDmIP7I=; b=WUyWK46uZ6v6MH8RCZMuo/Jykw\n\t9t6F5b7awvJnq5kxRDUYRZdE5iM0vWGigynVsKFJFv3ywVO/LA6KEMnJKsaY2UXenCaTEJm/MhGLT\n\tASRuREAV/LsYI9HXxXW0XgGMf7vaJu5glMUMsRllrIOOcmk4j6PH8sDm0e/lq8kj+YgahE0+v1wLh\n\tC9stW5/bgdZQgL9bislyw5+0bFHH7Ms6J69cJYPiGJufNOXvAH/j6GAyxynS822UeeK5wYJrb/akc\n\tKHg5XOGM0I4wNpsK4rNpqBMn/dsh7/m7itau7zCluwxxUTbJ8j967QVT9/BtgDqTpGVXkKEZFKhCY\n\tv6r5Hr/Q==;","Date":"Tue, 21 Apr 2026 20:49:51 +0100","From":"Jeremy Sowden <jeremy@azazel.net>","To":"Fernando Fernandez Mancera <fmancera@suse.de>","Cc":"netfilter-devel@vger.kernel.org, coreteam@netfilter.org, phil@nwl.cc,\n\tfw@strlen.de, pablo@netfilter.org","Subject":"Re: [PATCH nf] netfilter: nft_bitwise: fix dst corruption in same\n register shifts","Message-ID":"<20260421194951.GA1976704@celephais.dreamlands>","References":"<20260421173851.7945-2-fmancera@suse.de>","Precedence":"bulk","X-Mailing-List":"netfilter-devel@vger.kernel.org","List-Id":"<netfilter-devel.vger.kernel.org>","List-Subscribe":"<mailto:netfilter-devel+subscribe@vger.kernel.org>","List-Unsubscribe":"<mailto:netfilter-devel+unsubscribe@vger.kernel.org>","MIME-Version":"1.0","Content-Type":"multipart/signed; micalg=pgp-sha512;\n\tprotocol=\"application/pgp-signature\"; boundary=\"F81ePTK3g0a3riya\"","Content-Disposition":"inline","In-Reply-To":"<20260421173851.7945-2-fmancera@suse.de>","X-SA-Exim-Connect-IP":"2001:8b0:fb7d:d6d7:3c21:9cff:fe2f:35f","X-SA-Exim-Mail-From":"jeremy@azazel.net","X-SA-Exim-Scanned":"No (on taras.nevrast.org); SAEximRunCond expanded to false"}},{"id":3681321,"web_url":"http://patchwork.ozlabs.org/comment/3681321/","msgid":"<00d155a5-76f9-4011-90dd-e5ec94918740@suse.de>","list_archive_url":null,"date":"2026-04-23T08:07:03","subject":"Re: [PATCH nf] netfilter: nft_bitwise: fix dst corruption in same\n register shifts","submitter":{"id":90904,"url":"http://patchwork.ozlabs.org/api/people/90904/","name":"Fernando Fernandez Mancera","email":"fmancera@suse.de"},"content":"On 4/21/26 9:49 PM, Jeremy Sowden wrote:\n> On 2026-04-21, at 19:38:52 +0200, Fernando Fernandez Mancera wrote:\n>> For lshift and rshift, the shift operations are performed in a loop over\n>> 32-bit words. The loop calculates the shifted value and write it to dst,\n>> and then immediately reads from src to calculate the carry for the next\n>> iteration. Because src and dst could point to the same memory location,\n>> the carry is incorrectly calculated using the newly modified dst value\n>> instead of the original src value.\n>>\n>> Adding a temporal local variable to cache the original value before\n>             ^^^^^^^^\n> \n> \"Temporary\"?\n> \n>> writing to dst and using it for the carry calculation solves the\n>> problem. This was tested with the following payload:\n>>\n>> table test_table ip flags 0 use 1 handle 1\n>> ip test_table test_chain use 3 type filter hook input prio 0 policy \n>> accept packets 0 bytes 0 flags 1\n>> ip test_table test_chain 2\n>>   [ immediate reg 1 0x44332211 0x88776655 ]\n>>   [ bitwise reg 1 = ( reg 1 << 0x08000000 ) ]\n>>   [ cmp eq reg 1 0x66443322 0x00887766 ]\n>>   [ counter pkts 0 bytes 0 ]\n>> ip test_table test_chain 4 3\n>>   [ immediate reg 1 0x44332211 0x88776655 ]\n>>   [ bitwise reg 1 = ( reg 1 << 0x08000000 ) ]\n>>   [ cmp eq reg 1 0x55443322 0x00887766 ]\n>>   [ counter pkts 21794 bytes 1917798 ]\n>>\n>> Fixes: 567d746b55bc (\"netfilter: bitwise: add support for shifts.\")\n>> Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>\n> \n> Acked-By: Jeremy Sowden <jeremy@azazel.net>\n> \nThanks, I am preparing a v2 as sashiko spotted another problem and I \nhave verified it is real. See:\n\n\"\"\"\n  Does this leave the corruption issue unfixed for partial register \noverlaps? If userspace provides overlapping registers where dreg is less \nthan sreg, such as dreg=1 and sreg=2 with a len of 8, dst[1] aliases to \nsrc[0].\n\nIn the first iteration, this operation writes to dst[1]. In the second\niteration, it reads from src[0], which would now contain the newly\noverwritten value instead of the original source data.\n\"\"\"\n\nI am testing the new fix.\n\n>> ---\n>> Note: I found this issue while digging into the lshift/rshift operation\n>> ---\n>>  net/netfilter/nft_bitwise.c | 12 ++++++++----\n>>  1 file changed, 8 insertions(+), 4 deletions(-)\n>>\n>> diff --git a/net/netfilter/nft_bitwise.c b/net/netfilter/nft_bitwise.c\n>> index 13808e9cd999..136e8f3a71c5 100644\n>> --- a/net/netfilter/nft_bitwise.c\n>> +++ b/net/netfilter/nft_bitwise.c\n>> @@ -43,8 +43,10 @@ static void nft_bitwise_eval_lshift(u32 *dst, const \n>> u32 *src,\n>>      u32 carry = 0;\n>>\n>>      for (i = DIV_ROUND_UP(priv->len, sizeof(u32)); i > 0; i--) {\n>> -        dst[i - 1] = (src[i - 1] << shift) | carry;\n>> -        carry = src[i - 1] >> (BITS_PER_TYPE(u32) - shift);\n>> +        u32 tmp_src = src[i - 1];\n>> +\n>> +        dst[i - 1] = (tmp_src << shift) | carry;\n>> +        carry = tmp_src >> (BITS_PER_TYPE(u32) - shift);\n>>      }\n>>  }\n>>\n>> @@ -56,8 +58,10 @@ static void nft_bitwise_eval_rshift(u32 *dst, const \n>> u32 *src,\n>>      u32 carry = 0;\n>>\n>>      for (i = 0; i < DIV_ROUND_UP(priv->len, sizeof(u32)); i++) {\n>> -        dst[i] = carry | (src[i] >> shift);\n>> -        carry = src[i] << (BITS_PER_TYPE(u32) - shift);\n>> +        u32 tmp_src = src[i];\n>> +\n>> +        dst[i] = carry | (tmp_src >> shift);\n>> +        carry = tmp_src << (BITS_PER_TYPE(u32) - shift);\n>>      }\n>>  }\n>>\n>> -- \n>> 2.53.0\n>>","headers":{"Return-Path":"\n <netfilter-devel+bounces-12149-incoming=patchwork.ozlabs.org@vger.kernel.org>","X-Original-To":["incoming@patchwork.ozlabs.org","netfilter-devel@vger.kernel.org"],"Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (1024-bit key;\n unprotected) header.d=suse.de header.i=@suse.de header.a=rsa-sha256\n header.s=susede2_rsa header.b=HoadnRKk;\n\tdkim=pass header.d=suse.de header.i=@suse.de header.a=ed25519-sha256\n header.s=susede2_ed25519 header.b=KpEpZpYr;\n\tdkim=pass (1024-bit key) header.d=suse.de header.i=@suse.de\n header.a=rsa-sha256 header.s=susede2_rsa header.b=spGm+MrF;\n\tdkim=neutral header.d=suse.de header.i=@suse.de header.a=ed25519-sha256\n header.s=susede2_ed25519 header.b=qxQgqvCA;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=172.105.105.114; helo=tor.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-12149-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)","smtp.subspace.kernel.org;\n\tdkim=pass (1024-bit key) header.d=suse.de header.i=@suse.de\n header.b=\"HoadnRKk\";\n\tdkim=permerror (0-bit key) header.d=suse.de header.i=@suse.de\n header.b=\"KpEpZpYr\";\n\tdkim=pass (1024-bit key) header.d=suse.de header.i=@suse.de\n header.b=\"spGm+MrF\";\n\tdkim=permerror (0-bit key) header.d=suse.de header.i=@suse.de\n header.b=\"qxQgqvCA\"","smtp.subspace.kernel.org;\n arc=none smtp.client-ip=195.135.223.131","smtp.subspace.kernel.org;\n dmarc=pass (p=none dis=none) header.from=suse.de","smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=suse.de","smtp-out2.suse.de;\n\tnone"],"Received":["from tor.lore.kernel.org (tor.lore.kernel.org [172.105.105.114])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g1THN64vNz1y2d\n\tfor <incoming@patchwork.ozlabs.org>; Thu, 23 Apr 2026 18:08:16 +1000 (AEST)","from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby tor.lore.kernel.org (Postfix) with ESMTP id 6870D3072E3F\n\tfor <incoming@patchwork.ozlabs.org>; Thu, 23 Apr 2026 08:07:30 +0000 (UTC)","from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id C910B3644BC;\n\tThu, 23 Apr 2026 08:07:22 +0000 (UTC)","from smtp-out2.suse.de (smtp-out2.suse.de [195.135.223.131])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id AE2F9364024\n\tfor <netfilter-devel@vger.kernel.org>; Thu, 23 Apr 2026 08:07:20 +0000 (UTC)","from imap1.dmz-prg2.suse.org (unknown [10.150.64.97])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest\n SHA256)\n\t(No client certificate requested)\n\tby smtp-out2.suse.de (Postfix) with ESMTPS id 2E8EE5BCFD;\n\tThu, 23 Apr 2026 08:07:18 +0000 (UTC)","from imap1.dmz-prg2.suse.org (localhost [127.0.0.1])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest\n SHA256)\n\t(No client certificate requested)\n\tby imap1.dmz-prg2.suse.org (Postfix) with ESMTPS id CDAF6593A3;\n\tThu, 23 Apr 2026 08:07:17 +0000 (UTC)","from dovecot-director2.suse.de ([2a07:de40:b281:106:10:150:64:167])\n\tby imap1.dmz-prg2.suse.org with ESMTPSA\n\tid 8CFvLzXT6WlzXAAAD6G6ig\n\t(envelope-from <fmancera@suse.de>); Thu, 23 Apr 2026 08:07:17 +0000"],"ARC-Seal":"i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1776931642; cv=none;\n b=Eo+9sh2mmXZxFrN6/GciH3bu2XaboIRYRlCeXGNfYTiD3Tbe1ze/Wxx8yRzVUWnFqa5LmZyUzLxGl9A49z6y32N8onEvhA9z574OK06zex3mrlTBXti523tqiU8riWIq8XMmm+Mw2hn12YzIIEbFNIg3qDrJ6WOB69hJWesLCIg=","ARC-Message-Signature":"i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1776931642; c=relaxed/simple;\n\tbh=GC920YgwM4gDPrYX5Nr8pS6beuLQI8MQBk4Xa1QD29A=;\n\th=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From:\n\t In-Reply-To:Content-Type;\n b=kk6OMtczjBTZI562Tx9FLOt92kxgGsRKfFkNU8hSXQkb57CMYjlNuWDfbRlDTpP/1azS5dt/Kf7HoZq58F9etpLJes1JxUaOQnEDiJK9szy7Iz5upYU6dIetAItU5WTgQxDd9IMfAqiAQG6N0ewk2EHpPF9RbpnpvQsqZD1XRSo=","ARC-Authentication-Results":"i=1; smtp.subspace.kernel.org;\n dmarc=pass (p=none dis=none) header.from=suse.de;\n spf=pass smtp.mailfrom=suse.de;\n dkim=pass (1024-bit key) header.d=suse.de header.i=@suse.de\n header.b=HoadnRKk;\n dkim=permerror (0-bit key) header.d=suse.de header.i=@suse.de\n header.b=KpEpZpYr;\n dkim=pass (1024-bit key) header.d=suse.de header.i=@suse.de\n header.b=spGm+MrF;\n dkim=permerror (0-bit key) header.d=suse.de header.i=@suse.de\n header.b=qxQgqvCA; arc=none smtp.client-ip=195.135.223.131","DKIM-Signature":["v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.de;\n s=susede2_rsa;\n\tt=1776931639;\n h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc:\n\t mime-version:mime-version:content-type:content-type:\n\t content-transfer-encoding:content-transfer-encoding:\n\t in-reply-to:in-reply-to:references:references;\n\tbh=k3DWCrE7/tEab+2mucdJsTZQUB4Efb2SB+1uaReKlwU=;\n\tb=HoadnRKknk7Rx3/cdMUHyhNyBpYuT1Vl6sRyisl+kq2QAzYVqLoTZzNyBy5MZ8G+7xT2Y3\n\t5Mp6xJLeKCoO5xVxIryS97TOAhxJRwtkoNfAEhzZjHtbMopfC76DnrtdC+hELt39X3tGYD\n\tS85o5HOII5iCCneSH4fusG+NZaI60ds=","v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.de;\n\ts=susede2_ed25519; t=1776931639;\n\th=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc:\n\t mime-version:mime-version:content-type:content-type:\n\t content-transfer-encoding:content-transfer-encoding:\n\t in-reply-to:in-reply-to:references:references;\n\tbh=k3DWCrE7/tEab+2mucdJsTZQUB4Efb2SB+1uaReKlwU=;\n\tb=KpEpZpYraOZ4MrXefhI3eOvTGtHHxyN4Cn1hL/IHMmL3hkATK4NLy1YMeD3yEr71kYj0LU\n\tx5h9TfKge3VJc6Bw==","v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.de;\n s=susede2_rsa;\n\tt=1776931638;\n h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc:\n\t mime-version:mime-version:content-type:content-type:\n\t content-transfer-encoding:content-transfer-encoding:\n\t in-reply-to:in-reply-to:references:references;\n\tbh=k3DWCrE7/tEab+2mucdJsTZQUB4Efb2SB+1uaReKlwU=;\n\tb=spGm+MrFuvj0S0mwy02bjcCoMWMoaUkmkHj9wKUPUudx74MK5qncqjfRaL/kB95m2gxfwL\n\tlxXJwWaKfHoQt3hwvycMFOLM8hl+ujd/uNUQUn8zBu4HzHzBFb94D6/AKjmuDXYuVki00v\n\tO/pYA0iZlz18n/ydSqKK6CgYG+tur80=","v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.de;\n\ts=susede2_ed25519; t=1776931638;\n\th=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc:\n\t mime-version:mime-version:content-type:content-type:\n\t content-transfer-encoding:content-transfer-encoding:\n\t in-reply-to:in-reply-to:references:references;\n\tbh=k3DWCrE7/tEab+2mucdJsTZQUB4Efb2SB+1uaReKlwU=;\n\tb=qxQgqvCA8jSeqBELkVKkFMwZLQrNJfy0ECb23/GAtLjc0t4tP1MoX+a1Myv/SOAQx52ebC\n\tPLOv9IuM4VXavkDg=="],"Message-ID":"<00d155a5-76f9-4011-90dd-e5ec94918740@suse.de>","Date":"Thu, 23 Apr 2026 10:07:03 +0200","Precedence":"bulk","X-Mailing-List":"netfilter-devel@vger.kernel.org","List-Id":"<netfilter-devel.vger.kernel.org>","List-Subscribe":"<mailto:netfilter-devel+subscribe@vger.kernel.org>","List-Unsubscribe":"<mailto:netfilter-devel+unsubscribe@vger.kernel.org>","MIME-Version":"1.0","User-Agent":"Mozilla Thunderbird","Subject":"Re: [PATCH nf] netfilter: nft_bitwise: fix dst corruption in same\n register shifts","To":"Jeremy Sowden <jeremy@azazel.net>","Cc":"netfilter-devel@vger.kernel.org, coreteam@netfilter.org, phil@nwl.cc,\n fw@strlen.de, pablo@netfilter.org","References":"<20260421173851.7945-2-fmancera@suse.de>\n <20260421194951.GA1976704@celephais.dreamlands>","Content-Language":"en-US","From":"Fernando Fernandez Mancera <fmancera@suse.de>","In-Reply-To":"<20260421194951.GA1976704@celephais.dreamlands>","Content-Type":"text/plain; charset=UTF-8; format=flowed","Content-Transfer-Encoding":"8bit","X-Spamd-Result":"default: False [-4.30 / 50.00];\n\tBAYES_HAM(-3.00)[100.00%];\n\tNEURAL_HAM_LONG(-1.00)[-1.000];\n\tNEURAL_HAM_SHORT(-0.20)[-1.000];\n\tMIME_GOOD(-0.10)[text/plain];\n\tFUZZY_RATELIMITED(0.00)[rspamd.com];\n\tRCVD_VIA_SMTP_AUTH(0.00)[];\n\tMIME_TRACE(0.00)[0:+];\n\tARC_NA(0.00)[];\n\tTO_DN_SOME(0.00)[];\n\tMID_RHS_MATCH_FROM(0.00)[];\n\tRCVD_TLS_ALL(0.00)[];\n\tDKIM_SIGNED(0.00)[suse.de:s=susede2_rsa,suse.de:s=susede2_ed25519];\n\tFROM_HAS_DN(0.00)[];\n\tRCPT_COUNT_FIVE(0.00)[6];\n\tFROM_EQ_ENVFROM(0.00)[];\n\tTO_MATCH_ENVRCPT_ALL(0.00)[];\n\tRCVD_COUNT_TWO(0.00)[2];\n\tDBL_BLOCKED_OPENRESOLVER(0.00)[imap1.dmz-prg2.suse.org:helo,suse.de:mid,suse.de:email]","X-Spam-Flag":"NO","X-Spam-Score":"-4.30","X-Spam-Level":""}}]