From: Florian Westphal <fw@strlen.de>
To: <netdev@vger.kernel.org>
Cc: Paolo Abeni <pabeni@redhat.com>,
"David S. Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@google.com>,
Jakub Kicinski <kuba@kernel.org>,
<netfilter-devel@vger.kernel.org>,
pablo@netfilter.org
Subject: [PATCH net 9/9] netfilter: xt_physdev: masks are not c-strings
Date: Fri, 10 Jul 2026 16:37:33 +0200 [thread overview]
Message-ID: <20260710143733.29741-10-fw@strlen.de> (raw)
In-Reply-To: <20260710143733.29741-1-fw@strlen.de>
... and must not be subjected to the 'nul terminated' constraint.
If the interface name is 15 characters long, the mask is 16-bytes
'0xff' (to cover for \0) and the valid device name is rejected.
Fixes: 8df772afc9d0 ("netfilter: x_physdev: reject empty or not-nul terminated device names")
Closes: https://bugs.launchpad.net/neutron/+bug/2159935
Cc: stable@vger.kernel.org
Signed-off-by: Florian Westphal <fw@strlen.de>
---
net/netfilter/xt_physdev.c | 5 -----
1 file changed, 5 deletions(-)
diff --git a/net/netfilter/xt_physdev.c b/net/netfilter/xt_physdev.c
index dd98f758176c..a388881c68d4 100644
--- a/net/netfilter/xt_physdev.c
+++ b/net/netfilter/xt_physdev.c
@@ -130,11 +130,6 @@ static int physdev_mt_check(const struct xt_mtchk_param *par)
if (X(physoutdev))
return -ENAMETOOLONG;
}
-
- if (X(in_mask))
- return -ENAMETOOLONG;
- if (X(out_mask))
- return -ENAMETOOLONG;
#undef X
if (!brnf_probed) {
--
2.54.0
prev parent reply other threads:[~2026-07-10 14:38 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-10 14:37 [PATCH net 0/9] netfilter: updates for net Florian Westphal
2026-07-10 14:37 ` [PATCH net 1/9] netfilter: xt_nat: reject unsupported target families Florian Westphal
2026-07-10 14:37 ` [PATCH net 2/9] netfilter: ecache: fix inverted time_after() check Florian Westphal
2026-07-10 14:37 ` [PATCH net 3/9] netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() Florian Westphal
2026-07-10 14:37 ` [PATCH net 4/9] netfilter: nf_conncount: fix zone comparison in tuple dedup Florian Westphal
2026-07-10 14:37 ` [PATCH net 5/9] selftests: netfilter: add bridge tunnel flowtable regression Florian Westphal
2026-07-10 14:37 ` [PATCH net 6/9] netfilter: flowtable: use correct direction to set up tunnel route Florian Westphal
2026-07-10 14:37 ` [PATCH net 7/9] ipvs: reload ip header after head reallocation Florian Westphal
2026-07-10 14:37 ` [PATCH net 8/9] ipvs: fix more places with wrong ipv6 transport offsets Florian Westphal
2026-07-10 14:37 ` Florian Westphal [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260710143733.29741-10-fw@strlen.de \
--to=fw@strlen.de \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=kuba@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=pablo@netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.