Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/2227999/?format=api
{ "id": 2227999, "url": "http://patchwork.ozlabs.org/api/patches/2227999/?format=api", "web_url": "http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260424190513.32823-8-pablo@netfilter.org/", "project": { "id": 26, "url": "http://patchwork.ozlabs.org/api/projects/26/?format=api", "name": "Netfilter Development", "link_name": "netfilter-devel", "list_id": "netfilter-devel.vger.kernel.org", "list_email": "netfilter-devel@vger.kernel.org", "web_url": null, "scm_url": null, "webscm_url": null, "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<20260424190513.32823-8-pablo@netfilter.org>", "list_archive_url": null, "date": "2026-04-24T19:05:09", "name": "[net,07/11] netfilter: reject zero shift in nft_bitwise", "commit_ref": null, "pull_url": null, "state": "new", "archived": false, "hash": "edcaec31ab47b3e3a2c66d0393f4497305824cda", "submitter": { "id": 1315, "url": "http://patchwork.ozlabs.org/api/people/1315/?format=api", "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260424190513.32823-8-pablo@netfilter.org/mbox/", "series": [ { "id": 501399, "url": "http://patchwork.ozlabs.org/api/series/501399/?format=api", "web_url": "http://patchwork.ozlabs.org/project/netfilter-devel/list/?series=501399", "date": "2026-04-24T19:05:02", "name": "[net,01/11] netfilter: arp_tables: fix IEEE1394 ARP payload parsing", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/501399/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2227999/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2227999/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "\n <netfilter-devel+bounces-12188-incoming=patchwork.ozlabs.org@vger.kernel.org>", "X-Original-To": [ "incoming@patchwork.ozlabs.org", "netfilter-devel@vger.kernel.org" ], "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=netfilter.org header.i=@netfilter.org\n header.a=rsa-sha256 header.s=2025 header.b=Mxp3wkU0;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=172.234.253.10; helo=sea.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-12188-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)", "smtp.subspace.kernel.org;\n\tdkim=pass (2048-bit key) header.d=netfilter.org header.i=@netfilter.org\n header.b=\"Mxp3wkU0\"", "smtp.subspace.kernel.org;\n arc=none smtp.client-ip=217.70.190.124", "smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=netfilter.org", "smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=netfilter.org" ], "Received": [ "from sea.lore.kernel.org (sea.lore.kernel.org [172.234.253.10])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g2Mv93MkHz1yDD\n\tfor <incoming@patchwork.ozlabs.org>; Sat, 25 Apr 2026 05:08:53 +1000 (AEST)", "from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sea.lore.kernel.org (Postfix) with ESMTP id 93159303FF86\n\tfor <incoming@patchwork.ozlabs.org>; Fri, 24 Apr 2026 19:05:58 +0000 (UTC)", "from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id 985B23FA5E4;\n\tFri, 24 Apr 2026 19:05:56 +0000 (UTC)", "from mail.netfilter.org (mail.netfilter.org [217.70.190.124])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id CE6483FA5CF;\n\tFri, 24 Apr 2026 19:05:54 +0000 (UTC)", "from localhost.localdomain (mail-agni [217.70.190.124])\n\tby mail.netfilter.org (Postfix) with ESMTPSA id C3A2560284;\n\tFri, 24 Apr 2026 21:05:52 +0200 (CEST)" ], "ARC-Seal": "i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1777057556; cv=none;\n b=WAJMquZJPoR+5NpU7WDd4m0U6NoPLPeyjl6fT482zXzkTWuKSUYVCLRKKm7C95UYApQ9Od0tpsDGEmHLQKiASauEAFX8nH8lCbtEyKzXfAJX7G7cfnlLuQhruYGGNiu5p+Okf3RFFSicXTSXpiS4Dd6mT0+32SdPJvwXSxKpXfU=", "ARC-Message-Signature": "i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1777057556; c=relaxed/simple;\n\tbh=5auVh159NgHYnY9KURAEEAM3LkKuat/4fjrsARva74g=;\n\th=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:\n\t MIME-Version;\n b=l+gwxq5YAE7FDKj0or5sSELxXKgCM7ly8dqKqD61mfR7VRF99jt33d+D48Z4Q0LAr1TwJ1YIMn8d8Rlk5B/KoFC4gUfpYvTOPsSaKjMdVjUHwNIHiueh5vZ/psNlg7ycjnZPJ8iozagEcbtdDaHQSx20v60XG4UDhv1Ab/bqlUg=", "ARC-Authentication-Results": "i=1; smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=netfilter.org;\n spf=pass smtp.mailfrom=netfilter.org;\n dkim=pass (2048-bit key) header.d=netfilter.org header.i=@netfilter.org\n header.b=Mxp3wkU0; arc=none smtp.client-ip=217.70.190.124", "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=netfilter.org;\n\ts=2025; t=1777057553;\n\tbh=kvO4NiWkgz6Po7XmbFpN2ojH9hOJD7U1mcp/a6giG88=;\n\th=From:To:Cc:Subject:Date:In-Reply-To:References:From;\n\tb=Mxp3wkU09wdIEhKbv3xqGmr8WWckbK9o0hazTHE8qLlyyLdSBCfGM1Gm+Jhe7NYs0\n\t 5k5LZqCDBJoWDL4f2Z+eFm7EnzkralreC3f/U98l09e2o//65b4ClWIDFgge4yM7LQ\n\t kmtVKIvAFc1X79TFvm+exEXIzkRkKMdvXUv2GLlltNnc/4i16+P/OtKBDwayNe+8l6\n\t kwM300UqNxkurzipXqxe78DSV3gxuC7JGTf8huVlBQwOGSg0Ff5qrx6Ie23pkeePcu\n\t +RxppTt2FHADe5vVyfe3kgbWXdx37JjCcMjUET/w2WwS3epKGzZo15ewZPS5nDxVqI\n\t Kq0YL18svY/AQ==", "From": "Pablo Neira Ayuso <pablo@netfilter.org>", "To": "netfilter-devel@vger.kernel.org", "Cc": "davem@davemloft.net,\n\tnetdev@vger.kernel.org,\n\tkuba@kernel.org,\n\tpabeni@redhat.com,\n\tedumazet@google.com,\n\tfw@strlen.de,\n\thorms@kernel.org", "Subject": "[PATCH net 07/11] netfilter: reject zero shift in nft_bitwise", "Date": "Fri, 24 Apr 2026 21:05:09 +0200", "Message-ID": "<20260424190513.32823-8-pablo@netfilter.org>", "X-Mailer": "git-send-email 2.47.3", "In-Reply-To": "<20260424190513.32823-1-pablo@netfilter.org>", "References": "<20260424190513.32823-1-pablo@netfilter.org>", "Precedence": "bulk", "X-Mailing-List": "netfilter-devel@vger.kernel.org", "List-Id": "<netfilter-devel.vger.kernel.org>", "List-Subscribe": "<mailto:netfilter-devel+subscribe@vger.kernel.org>", "List-Unsubscribe": "<mailto:netfilter-devel+unsubscribe@vger.kernel.org>", "MIME-Version": "1.0", "Content-Transfer-Encoding": "8bit" }, "content": "From: Kai Ma <k4729.23098@gmail.com>\n\nReject zero shift operands for nft_bitwise left and right shift\nexpressions during initialization.\n\nThe carry propagation logic computes the carry from the adjacent 32-bit\nword using BITS_PER_TYPE(u32) - shift. A zero shift operand turns this\ninto a 32-bit shift, which is undefined behaviour.\n\nReject zero shift operands in the control plane, alongside the existing\ncheck for values greater than or equal to 32, so malformed rules never\nreach the packet path.\n\nFixes: 567d746b55bc (\"netfilter: bitwise: add support for shifts.\")\nCc: stable@kernel.org\nReported-by: Yuan Tan <yuantan098@gmail.com>\nReported-by: Yifan Wu <yifanwucs@gmail.com>\nReported-by: Juefei Pu <tomapufckgml@gmail.com>\nReported-by: Xin Liu <bird@lzu.edu.cn>\nSigned-off-by: Kai Ma <k4729.23098@gmail.com>\nSigned-off-by: Ren Wei <n05ec@lzu.edu.cn>\nReviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\n---\n net/netfilter/nft_bitwise.c | 3 ++-\n 1 file changed, 2 insertions(+), 1 deletion(-)", "diff": "diff --git a/net/netfilter/nft_bitwise.c b/net/netfilter/nft_bitwise.c\nindex 13808e9cd999..94dccdcfa06b 100644\n--- a/net/netfilter/nft_bitwise.c\n+++ b/net/netfilter/nft_bitwise.c\n@@ -196,7 +196,8 @@ static int nft_bitwise_init_shift(struct nft_bitwise *priv,\n \tif (err < 0)\n \t\treturn err;\n \n-\tif (priv->data.data[0] >= BITS_PER_TYPE(u32)) {\n+\tif (!priv->data.data[0] ||\n+\t priv->data.data[0] >= BITS_PER_TYPE(u32)) {\n \t\tnft_data_release(&priv->data, desc.type);\n \t\treturn -EINVAL;\n \t}\n", "prefixes": [ "net", "07/11" ] }