Re: [PATCH] net: sched: em_ipt: validate hook value from netlink

[Fang Xieyan <fangxy@xiaopeng.com>]

Hi,

Thanks for the automated review. Here's the additional information:

**How the issue was discovered:**
Identified through automated security scanning tools during internal 
security research, followed by manual code review to confirm the 
vulnerability and assess its impact.

**Whether the issue was actually triggered:**
Yes, successfully reproduced using QEMU/KVM with a kernel built with 
CONFIG_UBSAN=y, CONFIG_UBSAN_TRAP=y, and CONFIG_UBSAN_SHIFT=y.

**Symptoms:**
The reproducer creates a TC basic filter with em_ipt match using addrtype 
revision 1 and hook value 42 (out of valid NF_INET_* range 0-4). This 
triggers the following kernel Oops in check_match():

  Oops: invalid opcode: 0000 [#1] SMP NOPTI
  RIP: 0010:check_match.cold+0x0/0x2
  RCX: 000000000000002a    <- 0x2a = 42 (the hook value from PoC)

Disassembly confirms the ud2 trap instruction at check_match.cold+0x0 
corresponds to the UBSAN check for the shift operation "1 << im->hook".

Without UBSAN, on x86 the shift instruction may mask the count to low 
5 bits, yielding hook_mask = 0x400, which does not overlap the standard 
hook bits checked by the addrtype interface-limit validation.

Best regards,
Fang Xieyan