[PATCH nf 1/1] netfilter: xt_connmark: reject invalid shift parameters

[PATCH nf 1/1] netfilter: xt_connmark: reject invalid shift parameters

[Ren Wei]

From: Wyatt Feng <bronzed_45_vested@icloud.com>

Revision 2 of the CONNMARK target accepts user-controlled shift
parameters and applies them to 32-bit mark values in
connmark_tg_shift().

A shift_bits value of 32 or more triggers an undefined-shift bug when
the rule is evaluated. Invalid shift_dir values are also accepted and
silently fall back to the left-shift path.

Reject invalid revision-2 shift parameters in connmark_tg_check() so
malformed rules fail at installation time, before they can reach the
packet path.

Fixes: 472a73e00757 ("netfilter: xt_conntrack: Support bit-shifting for CONNMARK & MARK targets.")
Cc: stable@vger.kernel.org
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Zhengchuan Liang <zcliangcn@gmail.com>
Reported-by: Xin Liu <dstsmallbird@foxmail.com>
Assisted-by: Codex:GPT-5.4
Signed-off-by: Wyatt Feng <bronzed_45_vested@icloud.com>
Reviewed-by: Ren Wei <enjou1224z@gmail.com>
---
 net/netfilter/xt_connmark.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/net/netfilter/xt_connmark.c b/net/netfilter/xt_connmark.c
index 4277084de2e7..b7fdc3e9d423 100644
--- a/net/netfilter/xt_connmark.c
+++ b/net/netfilter/xt_connmark.c
@@ -103,8 +103,14 @@ connmark_tg_v2(struct sk_buff *skb, const struct xt_action_param *par)
 
 static int connmark_tg_check(const struct xt_tgchk_param *par)
 {
+	const struct xt_connmark_tginfo2 *info = par->targinfo;
 	int ret;
 
+	if (par->target->revision == 2) {
+		if (info->shift_dir > D_SHIFT_RIGHT || info->shift_bits >= 32)
+			return -EINVAL;
+	}
+
 	ret = nf_ct_netns_get(par->net, par->family);
 	if (ret < 0)
 		pr_info_ratelimited("cannot load conntrack support for proto=%u\n",
-- 
2.47.3

Re: [PATCH nf 1/1] netfilter: xt_connmark: reject invalid shift parameters

[Phil Sutter]

On Fri, Jul 03, 2026 at 01:04:46PM +0800, Ren Wei wrote:
> From: Wyatt Feng <bronzed_45_vested@icloud.com>
> 
> Revision 2 of the CONNMARK target accepts user-controlled shift
> parameters and applies them to 32-bit mark values in
> connmark_tg_shift().
> 
> A shift_bits value of 32 or more triggers an undefined-shift bug when
> the rule is evaluated. Invalid shift_dir values are also accepted and
> silently fall back to the left-shift path.
> 
> Reject invalid revision-2 shift parameters in connmark_tg_check() so
> malformed rules fail at installation time, before they can reach the
> packet path.
> 
> Fixes: 472a73e00757 ("netfilter: xt_conntrack: Support bit-shifting for CONNMARK & MARK targets.")
> Cc: stable@vger.kernel.org
> Reported-by: Yuan Tan <yuantan098@gmail.com>
> Reported-by: Zhengchuan Liang <zcliangcn@gmail.com>
> Reported-by: Xin Liu <dstsmallbird@foxmail.com>
> Assisted-by: Codex:GPT-5.4
> Signed-off-by: Wyatt Feng <bronzed_45_vested@icloud.com>
> Reviewed-by: Ren Wei <enjou1224z@gmail.com>

Reviewed-by: Phil Sutter <phil@nwl.cc>