Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Wed, 11 Dec 2019 23:04:21 +0100
From:   Pablo Neira Ayuso <pablo@netfilter.org>
To:     Arnd Bergmann <arnd@arndb.de>
Cc:     Jozsef Kadlecsik <kadlec@netfilter.org>,
        Florian Westphal <fw@strlen.de>,
        "David S. Miller" <davem@davemloft.net>, wenxu <wenxu@ucloud.cn>,
        netfilter-devel@vger.kernel.org, coreteam@netfilter.org,
        netdev@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] netfilter: nf_flow_table: fix big-endian integer overflow
Message-ID: <20191211220421.jrirqeyogry4pnlw@salvia>
References: <20191210202443.2226043-1-arnd@arndb.de>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20191210202443.2226043-1-arnd@arndb.de>
User-Agent: NeoMutt/20170113 (1.7.2)
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

Hi Arnd,

On Tue, Dec 10, 2019 at 09:24:28PM +0100, Arnd Bergmann wrote:
> In some configurations, gcc reports an integer overflow:
> 
> net/netfilter/nf_flow_table_offload.c: In function 'nf_flow_rule_match':
> net/netfilter/nf_flow_table_offload.c:80:21: error: unsigned conversion from 'int' to '__be16' {aka 'short unsigned int'} changes value from '327680' to '0' [-Werror=overflow]
>    mask->tcp.flags = TCP_FLAG_RST | TCP_FLAG_FIN;
>                      ^~~~~~~~~~~~
> 
> From what I can tell, we want the upper 16 bits of these constants,
> so they need to be shifted in cpu-endian mode.
> 
> Fixes: c29f74e0df7a ("netfilter: nf_flow_table: hardware offload support")
> Signed-off-by: Arnd Bergmann <arnd@arndb.de>
> ---
> I'm not sure if this is the correct fix, please check carefully

Thanks. I posted this one:

https://patchwork.ozlabs.org/patch/1206384/

The flow dissector matching on tcp flags seems also broken on big-endian.