{"id":2223258,"url":"http://patchwork.ozlabs.org/api/patches/2223258/?format=json","web_url":"http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260414221401.2809350-1-xmei5@asu.edu/","project":{"id":26,"url":"http://patchwork.ozlabs.org/api/projects/26/?format=json","name":"Netfilter Development","link_name":"netfilter-devel","list_id":"netfilter-devel.vger.kernel.org","list_email":"netfilter-devel@vger.kernel.org","web_url":null,"scm_url":null,"webscm_url":null,"list_archive_url":"","list_archive_url_format":"","commit_url_format":""},"msgid":"<20260414221401.2809350-1-xmei5@asu.edu>","list_archive_url":null,"date":"2026-04-14T22:14:01","name":"[nf,v2] netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO","commit_ref":null,"pull_url":null,"state":"new","archived":false,"hash":"e86eb5b7f50dfb83611738c26422db9076f63311","submitter":{"id":93033,"url":"http://patchwork.ozlabs.org/api/people/93033/?format=json","name":"Xiang Mei","email":"xmei5@asu.edu"},"delegate":null,"mbox":"http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260414221401.2809350-1-xmei5@asu.edu/mbox/","series":[{"id":499895,"url":"http://patchwork.ozlabs.org/api/series/499895/?format=json","web_url":"http://patchwork.ozlabs.org/project/netfilter-devel/list/?series=499895","date":"2026-04-14T22:14:01","name":"[nf,v2] netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO","version":2,"mbox":"http://patchwork.ozlabs.org/series/499895/mbox/"}],"comments":"http://patchwork.ozlabs.org/api/patches/2223258/comments/","check":"pending","checks":"http://patchwork.ozlabs.org/api/patches/2223258/checks/","tags":{},"related":[],"headers":{"Return-Path":"\n ","X-Original-To":["incoming@patchwork.ozlabs.org","netfilter-devel@vger.kernel.org"],"Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=asu.edu header.i=@asu.edu header.a=rsa-sha256\n header.s=google header.b=qboAuy7t;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c04:e001:36c::12fc:5321; helo=tor.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-11896-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)","smtp.subspace.kernel.org;\n\tdkim=pass (2048-bit key) header.d=asu.edu header.i=@asu.edu\n header.b=\"qboAuy7t\"","smtp.subspace.kernel.org;\n arc=none smtp.client-ip=74.125.82.46","smtp.subspace.kernel.org;\n dmarc=pass (p=none dis=none) header.from=asu.edu","smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=asu.edu"],"Received":["from tor.lore.kernel.org (tor.lore.kernel.org\n [IPv6:2600:3c04:e001:36c::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fwJTv6sQZz1yD5\n\tfor ; Wed, 15 Apr 2026 08:14:27 +1000 (AEST)","from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby tor.lore.kernel.org (Postfix) with ESMTP id 8ABDC307AACC\n\tfor ; Tue, 14 Apr 2026 22:14:15 +0000 (UTC)","from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id 8C4E838A715;\n\tTue, 14 Apr 2026 22:14:14 +0000 (UTC)","from mail-dl1-f46.google.com (mail-dl1-f46.google.com\n [74.125.82.46])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id C9D7B389472\n\tfor ; Tue, 14 Apr 2026 22:14:12 +0000 (UTC)","by mail-dl1-f46.google.com with SMTP id\n a92af1059eb24-126ea4b77adso15187139c88.1\n for ;\n Tue, 14 Apr 2026 15:14:12 -0700 (PDT)","from p1.scai.dhcp.asu.edu (209-147-138-15.nat.asu.edu.\n [209.147.138.15])\n by smtp.gmail.com with ESMTPSA id\n a92af1059eb24-12c4b323428sm13517785c88.4.2026.04.14.15.14.10\n (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n Tue, 14 Apr 2026 15:14:11 -0700 (PDT)"],"ARC-Seal":"i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1776204854; cv=none;\n b=NqYVKqUy8OBz0HBDc4CUZeCKoK6V0rYYxYGbmQWz+iAXnc7D9JFZzaRAa+Z2IwqY0fAxtVLXRRBAR2vSMN0k4xGzBrfAL11ng4KF6WhMtAeM6FhHSE/jjCffV28SiJDNVKW26Mx2W7zgamagGmXkd++oYyd060efJ8aAhzl8PNg=","ARC-Message-Signature":"i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1776204854; c=relaxed/simple;\n\tbh=/CumOeAjJXXsmb/6L/suQapO1UW2/F8scULcYprsNlI=;\n\th=From:To:Cc:Subject:Date:Message-ID:MIME-Version;\n b=bCExhRF5TgiveryQsr4Mf4KKpqlg4dBRtSEOvLf8tP1hjSfFCN5+LdDLxg8ULCvLmVIbH25Aesp8/6MQiZu2hUy92wln+ik77V6/exfa8RPA196ZB8aFu2PS5JpFrRpZ0Vg/aGf0s12iHy3ywykaFNary+XfmVpM8VUJvnICX6M=","ARC-Authentication-Results":"i=1; smtp.subspace.kernel.org;\n dmarc=pass (p=none dis=none) header.from=asu.edu;\n spf=pass smtp.mailfrom=asu.edu;\n dkim=pass (2048-bit key) header.d=asu.edu header.i=@asu.edu\n header.b=qboAuy7t; arc=none smtp.client-ip=74.125.82.46","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=asu.edu; s=google; t=1776204852; x=1776809652; darn=vger.kernel.org;\n h=content-transfer-encoding:mime-version:message-id:date:subject:cc\n :to:from:from:to:cc:subject:date:message-id:reply-to;\n bh=/8oDk6Bv3/p8vkApYwMdU44Wt3x0ddwL222gIoY0s4w=;\n b=qboAuy7tnwO0jvVNjO9eA86rTj/BEHhJ3THfVZ6aLU60f7La0Jz3hU2XqV65z0v8Re\n l53Cp0PCtfRll7h0BeOUWkVx/u1ILtHG/D/sLAkC1XdYCp92l+iYTr3xE3pBwPpbBafM\n cPYzJnB/udl4meL4EMdqMtHdwHxNL30M8XlsK18BIe4mfbQILklY68yg2LqBg19ueYJ/\n 50qWpuS4wJOqgymQhvCgRnPlNAN5sStJtbVIgWQ7PzAefpAYWfrqWlI2C9DcDlzwyhcs\n pYIPqBUzsFg9y8rwnMVs4EsqYr9NNekeVIgGZ04tGRutOEQdPoKTXr2FxBpfJMZPHMCj\n ix8A==","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1776204852; x=1776809652;\n h=content-transfer-encoding:mime-version:message-id:date:subject:cc\n :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date\n :message-id:reply-to;\n bh=/8oDk6Bv3/p8vkApYwMdU44Wt3x0ddwL222gIoY0s4w=;\n b=G6EnW+B3VzRYMX8JlFbG662q2JkR4wKv247DVA2xsa86M8tpdXC3zr2MNmm6H1ULKb\n Sgj2POEk73WroINBcnHQ5bRLZJU25lW7kAvwF6uD3BsnceEok1C/X3nYUqqfjZyU4ldb\n xPb0/0F/lYRkF0k5pDRAVjl0+UOUsE8qonabyjAlN0AQT80551Z1hvkF/FPufL8GhlLR\n AJioY5QsHnR4aPLpBsGIACkiUS7Z43fLItyJjYge6bsPQ5LhMedDywJ+eECe+bOZexfR\n cQ7EotfpaoOCDGkGLzmxfsltF1y7SZVaMmd1CK/IvVId1ETOyFiuSWZMWU6B9YCRcbPH\n kDuw==","X-Gm-Message-State":"AOJu0Ywd0l89xkpOyZvV0iHOjUUzC9Kj2jCElXyJS64Y8XpiZ5l0v55W\n\tCNC/yDrT/+v6wGQFW2wrH1C1gDHwPY0Wu5tLLQYDnlHMkrxJ5QQtgkzUrHHlLRca/BhMTWj3cWZ\n\t1HKxJiw==","X-Gm-Gg":"AeBDiesUb2Gypy9b+Y4K+jekjh83LpsJ1iYy485Hi5lA2/f3unTJUfJoYVkzwsZiRcw\n\txdgcX3/kjNplxJwBz+OJw1LNWyf/mBbyormYLhNeDFzABUsZpTr7U1YyzNUB8L9BS0+O/e7neM8\n\tQfI/4VypP+H5Bgjh9J4Ygrk6ULsaJhNGSWOytME7S7uc14hmgkZuZGYcdOjev2KfrkQ5ljCNFud\n\tzH4cwPcWzPrranYhazpEp0l9ajhnBJAcYSr5ILq8IupY02I8zS+vT6ykYaZm9mdE7BgXJq12DwG\n\tTm6VleqKYRpQvIlLFgPFvmvyRAJTzvVL3AbrDwUdJi+97JJwa8p31O6Qi+PLpk9GGRW/HRN56yI\n\tadWdRmPPpMCIEvsjm0xB7K06xxY6wyxeGcR3kRRYMZ0BbQv6nxE6Qc+L5vFRZ2D7k7uhN/roHKU\n\t5u4yo61nVVv4mIgxrK3B+24qvbhQLVLaJReCtpGRVs8kQVqGkEvEOjxQby7R3mcvys","X-Received":"by 2002:a05:7022:6726:b0:119:e56c:18ae with SMTP id\n a92af1059eb24-12c34ede8e2mr10335876c88.22.1776204851535;\n Tue, 14 Apr 2026 15:14:11 -0700 (PDT)","From":"Xiang Mei ","To":"netfilter-devel@vger.kernel.org","Cc":"Pablo Neira Ayuso ,\n\tFlorian Westphal ,\n\tPhil Sutter ,\n\tcoreteam@netfilter.org,\n\tWeiming Shi ,\n\tXiang Mei ","Subject":"[PATCH nf v2] netfilter: nfnetlink_osf: fix divide-by-zero in\n OSF_WSS_MODULO","Date":"Tue, 14 Apr 2026 15:14:01 -0700","Message-ID":"<20260414221401.2809350-1-xmei5@asu.edu>","X-Mailer":"git-send-email 2.43.0","Precedence":"bulk","X-Mailing-List":"netfilter-devel@vger.kernel.org","List-Id":"","List-Subscribe":"","List-Unsubscribe":"","MIME-Version":"1.0","Content-Transfer-Encoding":"8bit"},"content":"nf_osf_match_one() computes ctx->window % f->wss.val in the\nOSF_WSS_MODULO branch with no guard for f->wss.val == 0. A\nCAP_NET_ADMIN user can add such a fingerprint via nfnetlink; a\nsubsequent matching TCP SYN divides by zero and panics the kernel.\n\nReject the bogus fingerprint in nfnl_osf_add_callback() above the\nper-option for-loop. f->wss is per-fingerprint, not per-option, so\nthe check must run regardless of f->opt_num (including 0). Also\nreject wss.wc >= OSF_WSS_MAX; nf_osf_match_one() already treats that\nas \"should not happen\".\n\nCrash:\n Oops: divide error: 0000 [#1] SMP KASAN NOPTI\n RIP: 0010:nf_osf_match_one (net/netfilter/nfnetlink_osf.c:98)\n Call Trace:\n \n nf_osf_match (net/netfilter/nfnetlink_osf.c:220)\n xt_osf_match_packet (net/netfilter/xt_osf.c:32)\n ipt_do_table (net/ipv4/netfilter/ip_tables.c:348)\n nf_hook_slow (net/netfilter/core.c:622)\n ip_local_deliver (net/ipv4/ip_input.c:265)\n ip_rcv (include/linux/skbuff.h:1162)\n __netif_receive_skb_one_core (net/core/dev.c:6181)\n process_backlog (net/core/dev.c:6642)\n __napi_poll (net/core/dev.c:7710)\n net_rx_action (net/core/dev.c:7945)\n handle_softirqs (kernel/softirq.c:622)\n\nFixes: 11eeef41d5f6 (\"netfilter: passive OS fingerprint xtables match\")\nReported-by: Weiming Shi \nSuggested-by: Florian Westphal \nSuggested-by: Pablo Neira Ayuso \nSigned-off-by: Xiang Mei \n---\nv2: Fix the bug in configure path and correct the fix tag\n\n net/netfilter/nfnetlink_osf.c | 4 ++++\n 1 file changed, 4 insertions(+)","diff":"diff --git a/net/netfilter/nfnetlink_osf.c b/net/netfilter/nfnetlink_osf.c\nindex 45d9ad231..70172ca07 100644\n--- a/net/netfilter/nfnetlink_osf.c\n+++ b/net/netfilter/nfnetlink_osf.c\n@@ -320,6 +320,10 @@ static int nfnl_osf_add_callback(struct sk_buff *skb,\n \tif (f->opt_num > ARRAY_SIZE(f->opt))\n \t\treturn -EINVAL;\n \n+\tif (f->wss.wc >= OSF_WSS_MAX ||\n+\t (f->wss.wc == OSF_WSS_MODULO && f->wss.val == 0))\n+\t\treturn -EINVAL;\n+\n \tfor (i = 0; i < f->opt_num; i++) {\n \t\tif (!f->opt[i].length || f->opt[i].length > MAX_IPOPTLEN)\n \t\t\treturn -EINVAL;\n","prefixes":["nf","v2"]}