Re: [PATCH] netfilter: xt_HL: add pr_fmt, default case and NULL checks

Florian Westphal
2026-04-03T19:46:58Z

Marino Dzalto <marino.dzalto@gmail.com> wrote:
> Signed-off-by: Marino Dzalto <marino.dzalto@gmail.com>
> ---
> net/netfilter/xt_hl.c | 25 +++++++++++++++++++------
> 1 file changed, 19 insertions(+), 6 deletions(-)
>
> diff --git a/net/netfilter/xt_hl.c b/net/netfilter/xt_hl.c
> index c1a70f8f0..9434d5ca8 100644
> --- a/net/netfilter/xt_hl.c
> +++ b/net/netfilter/xt_hl.c
> @@ -6,6 +6,7 @@
> * Hop Limit matching module
> * (C) 2001-2002 Maciej Soltysiak <solt@dns.toxicfilms.tv>
> */
> +#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
>
> #include <linux/ip.h>
> #include <linux/ipv6.h>
> @@ -25,7 +26,12 @@ MODULE_ALIAS("ip6t_hl");
> static bool ttl_mt(const struct sk_buff *skb, struct xt_action_param *par)
> {
> const struct ipt_ttl_info *info = par->matchinfo;
> - const u8 ttl = ip_hdr(skb)->ttl;
> + const u8 ttl;
> +
> + if (!skb)
> + return false;

If this was NULL we'd have crashed already.

> case IPT_TTL_GT:
> return ttl > info->ttl;
> + default:
> + pr_warn("Unknown TTL match mode: %d\n", info->mode);
> + return false;

Please add a .checkentry function and reject this from there.