Re: [PATCH net v2] net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@xxxxxxxxxx>:

On Thu, 23 Jul 2026 00:49:55 -0400 you wrote:
> u32_change() copies the user-provided tc_u32_sel.offshift (unsigned char,
> 0-255) into the kernel knode object without bounds validation. When a
> packet later hits u32_classify() with TC_U32_VAROFFSET set, it evaluates
> `ntohs(offmask & *data) >> offshift` where the left operand is a 16-bit
> value promoted to a 32-bit int. Any offshift >= 32 is undefined behavior
> per C11 6.5.7p3, triggerable by an unprivileged user via user/network
> namespaces.
> 
> [...]

Here is the summary with links:
  - [net,v2] net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds
    https://git.kernel.org/netdev/net/c/aef96eead286

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html