linux-kernel - [PATCH v2] bpf: fix netfilter link comparison to handle unsigned flags

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <tencent_E0C8EAB7EBECF90582B0CD21490DBCF53A0A@qq.com>
Date: Mon, 22 Sep 2025 10:11:06 +0800
From: Haofeng Li <920484857@...com>
To: Quentin Monnet <qmo@...nel.org>
Cc: Alexei Starovoitov <ast@...nel.org>,
	Daniel Borkmann <daniel@...earbox.net>,
	Andrii Nakryiko <andrii@...nel.org>,
	linux-kernel@...r.kernel.org,
	Haofeng Li <13266079573@....com>,
	lihaofeng <lihaofeng@...inos.cn>
Subject: [PATCH v2] bpf: fix netfilter link comparison to handle unsigned flags

From: lihaofeng <lihaofeng@...inos.cn>

The original implementation of netfilter_link_compar() used subtraction
to compare the netfilter.flags field, which is  an unsigned type.
This could result in incorrect comparison results when the unsigned
value wrapped around due to underflow.

Changed the comparison logic for flags to use explicit conditional
checks (similar to how priority is handled) instead of subtraction,
ensuring correct negative/zero/positive return values regardless of
the underlying data type.

This fixes potential sorting issues when using this comparison function
with algorithms like qsort() or bsearch().

Signed-off-by: lihaofeng <lihaofeng@...inos.cn>
---
Changes in v2:
- Added conditional checks for all fields (pf, hooknum, flags) to prevent
- overflow while preserving consistent comparison style and original order.
---
 tools/bpf/bpftool/net.c | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/tools/bpf/bpftool/net.c b/tools/bpf/bpftool/net.c
index cfc6f944f7c3..a8caea07be8f 100644
--- a/tools/bpf/bpftool/net.c
+++ b/tools/bpf/bpftool/net.c
@@ -801,22 +801,27 @@ static int netfilter_link_compar(const void *a, const void *b)
 {
 	const struct bpf_link_info *nfa = a;
 	const struct bpf_link_info *nfb = b;
-	int delta;
 
-	delta = nfa->netfilter.pf - nfb->netfilter.pf;
-	if (delta)
-		return delta;
+	if (nfa->netfilter.pf < nfb->netfilter.pf)
+		return -1;
+	if (nfa->netfilter.pf > nfb->netfilter.pf)
+		return 1;
 
-	delta = nfa->netfilter.hooknum - nfb->netfilter.hooknum;
-	if (delta)
-		return delta;
+	if (nfa->netfilter.hooknum < nfb->netfilter.hooknum)
+		return -1;
+	if (nfa->netfilter.hooknum > nfb->netfilter.hooknum)
+		return 1;
 
 	if (nfa->netfilter.priority < nfb->netfilter.priority)
 		return -1;
 	if (nfa->netfilter.priority > nfb->netfilter.priority)
 		return 1;
 
-	return nfa->netfilter.flags - nfb->netfilter.flags;
+	if (nfa->netfilter.flags < nfb->netfilter.flags)
+		return -1;
+	if (nfa->netfilter.flags > nfb->netfilter.flags)
+		return 1;
+	return 0;
 }
 
 static void show_link_netfilter(void)
-- 
2.25.1