# Re: \[PATCH net\] net/sched: em\_ipt: reject hook values \>= NF\_INET\_NUMHOOKS

- From: khj \<hidden\>
- Date: 2026-10-29 16:47:53 
- List: netdev
- Page: https://ratatoskr.run/netdev/2026/10/17828275
- Thread: https://ratatoskr.run/netdev/2026/10/17828200/t.md

```text
Hi,

Thanks. The issue was found by static analysis: a small checker that flags
values read from netlink attributes (nla_get_u8/u16/u32) that are then used
as a shift count without a range check. em_ipt's TCA_EM_IPT_HOOK was flagged
because it has no nla_policy bound and only the "policy" match validates the
hook, while the "addrtype" match does not. I then confirmed it at runtime
with UBSAN using the reproducer described in the commit message (a basic
classifier with an em_ipt "addrtype" ematch and TCA_EM_IPT_HOOK = 32).

Thanks,
Hyunjung Ko

2026년 10월 30일 (금) 오전 1:38, [ref]님이 작성:
>
> Hi!
>
> This is an automated message. This series looks like a fix, but its
> commit messages seem to be missing some information:
>
>  - How the issue was discovered, e.g. hit in production, hit during
>    development, syzbot report, manual code inspection, LLM or static
>    analysis tool scan.
>
> Please do not repost the series just to address the above. Instead,
> reply to this email with the missing information, so that reviewers
> can take it into account. If the series needs another revision for
> other reasons, please include the information in the commit messages
> then.
>
> The evaluation is done by an LLM so it may be wrong, if you think
> that is the case please reply and explain.
```