Re: [PATCH] netfilter: ctnetlink: use netlink policy range checks

[patchwork-bot+netdevbpf@kernel.org]

Hello:

This patch was applied to netdev/net.git (main)
by Pablo Neira Ayuso <pablo@netfilter.org>:

On Tue, 24 Mar 2026 17:12:59 +0000 you wrote:
> Replace manual range and mask validations with netlink policy
> annotations in ctnetlink code paths, so that the netlink core rejects
> invalid values early and can generate extack errors.
> 
> - CTA_PROTOINFO_TCP_STATE: reject values > TCP_CONNTRACK_SYN_SENT2 at
>   policy level, removing the manual >= TCP_CONNTRACK_MAX check.
> - CTA_PROTOINFO_TCP_WSCALE_ORIGINAL/REPLY: reject values > TCP_MAX_WSCALE
>   (14). The normal TCP option parsing path already clamps to this value,
>   but the ctnetlink path accepted 0-255, causing undefined behavior when
>   used as a u32 shift count.
> - CTA_FILTER_ORIG_FLAGS/REPLY_FLAGS: use NLA_POLICY_MASK with
>   CTA_FILTER_F_ALL, removing the manual mask checks.
> - CTA_EXPECT_FLAGS: use NLA_POLICY_MASK with NF_CT_EXPECT_MASK, adding
>   a new mask define grouping all valid expect flags.
> 
> [...]

Here is the summary with links:
  - netfilter: ctnetlink: use netlink policy range checks
    https://git.kernel.org/netdev/net/c/8f15b5071b45

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html