Re: [PATCH nf 1/1] netfilter: xt_time: reject pre-epoch calendar matching

[Phil Sutter <phil@nwl.cc>]

On Fri, Jul 03, 2026 at 03:32:43PM +0800, Ren Wei wrote:
> From: Zhengyang Chen <chzhengyang2023@lzu.edu.cn>
> 
> When XT_TIME_CONTIGUOUS handles a cross-day daytime range, packets in
> the post-midnight part of the range are matched against the previous
> calendar day by subtracting SECONDS_PER_DAY from stamp.
> 
> On the first day after the epoch, this backdating can make the signed
> time64_t stamp negative. localtime_2() and localtime_3() then feed the
> value into unsigned division helpers and derive wrapped calendar fields.
> In particular, monthday can become larger than the valid 1..31 range,
> leading time_mt() to evaluate an out-of-range
> 1U << current_time.monthday shift.
> 
> The date_start/date_stop ABI is unsigned and cannot represent pre-epoch
> calendar dates. If contiguous matching backdates stamp before the epoch,
> only rules without weekday and monthday constraints can still be
> evaluated safely; reject calendar-constrained rules before converting
> the timestamp to calendar fields.
> 
> Fixes: 54eb3df3a7d0 ("netfilter: xt_time: add support to ignore day transition")
> Cc: stable@vger.kernel.org
> Reported-by: Yuan Tan <yuantan098@gmail.com>
> Reported-by: Xin Liu <dstsmallbird@foxmail.com>
> Assisted-by: Codex:gpt-5.4
> Signed-off-by: Zhengyang Chen <chzhengyang2023@lzu.edu.cn>
> Reviewed-by: Ren Wei <enjou1224z@gmail.com>

Reviewed-by: Phil Sutter <phil@nwl.cc>