From 94cea342e8915812b45f93c56e134041c7fdb4d7 Mon Sep 17 00:00:00 2001 From: Fang Xieyan Date: Mon, 26 Oct 2026 17:07:17 +0800 Subject: [PATCH] net: sched: em_ipt: validate hook value from netlink em_ipt_change() accepts the user-provided TCA_EM_IPT_HOOK value without validating its range. The value is later used in check_match() as "1 << im->hook". A hook value of 32 or greater causes undefined behavior and may undermine the xt match hook-mask validation. The value is also passed to nf_hook_state_init() as a hook index. Reject hook values outside the supported IPv4/IPv6 Netfilter hook range after checking the required attributes, before loading the xt match or allocating the match state. Reviewed-by: Weibin Liu Signed-off-by: Fang Xieyan Signed-off-by: Dave Miller --- net/sched/em_ipt.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/sched/em_ipt.c b/net/sched/em_ipt.c index 3650117da47f..26f1c4269a48 100644 --- a/net/sched/em_ipt.c +++ b/net/sched/em_ipt.c @@ -141,6 +141,9 @@ static int em_ipt_change(struct net *net, void *data, int data_len, !tb[TCA_EM_IPT_MATCH_DATA] || !tb[TCA_EM_IPT_NFPROTO]) return -EINVAL; + if (nla_get_u32(tb[TCA_EM_IPT_HOOK]) >= NF_INET_NUMHOOKS) + return -EINVAL; + nfproto = nla_get_u8(tb[TCA_EM_IPT_NFPROTO]); switch (nfproto) { case NFPROTO_IPV4: