)]}'
{
  "commit": "530d6a57e6fea7de26a9600dd43f981ade00d33e",
  "tree": "92ab0edc42546d35a5212f308775fc6211bbb0ac",
  "parents": [
    "a0ed6089aa43e2cfdaf705f8d0c0507a14a785f6"
  ],
  "author": {
    "name": "Pablo Neira Ayuso",
    "email": "pablo@netfilter.org",
    "time": "Tue Apr 22 21:52:43 2025 +0200"
  },
  "committer": {
    "name": "Derek Taylor",
    "email": "ddtaylor@google.com",
    "time": "Tue Mar 10 10:27:11 2026 -0700"
  },
  "message": "netfilter: nft_set_pipapo: prevent overflow in lookup table allocation\n\ncommit 4c5c6aa9967dbe55bd017bb509885928d0f31206 upstream.\n\nWhen calculating the lookup table size, ensure the following\nmultiplication does not overflow:\n\n- desc-\u003efield_len[] maximum value is U8_MAX multiplied by\n  NFT_PIPAPO_GROUPS_PER_BYTE(f) that can be 2, worst case.\n- NFT_PIPAPO_BUCKETS(f-\u003ebb) is 2^8, worst case.\n- sizeof(unsigned long), from sizeof(*f-\u003elt), lt in\n  struct nft_pipapo_field.\n\nThen, use check_mul_overflow() to multiply by bucket size and then use\ncheck_add_overflow() to the alignment for avx2 (if needed). Finally, add\nlt_size_check_overflow() helper and use it to consolidate this.\n\nWhile at it, replace leftover allocation using the GFP_KERNEL to\nGFP_KERNEL_ACCOUNT for consistency, in pipapo_resize().\n\nBUG\u003db/462683074\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed CVE-2025-38162 in the Linux kernel.\n\ncos-patch: security-moderate\nFixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nReviewed-by: Stefano Brivio \u003csbrivio@redhat.com\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n[ Adjust context ]\nSigned-off-by: Bin Lan \u003clanbincn@139.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nChange-Id: Ib075b53e5b4ef3183bae4150f5266ea9c0ddc61a\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/136607\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nReviewed-by: Robert Kolchmeyer \u003crkolchmeyer@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "63235c44f67a7278fbdeff0f730af946d7659beb",
      "old_mode": 33188,
      "old_path": "net/netfilter/nft_set_pipapo.c",
      "new_id": "c3ada6798d4a3f06b395f1b3fe94fd5b8902dbca",
      "new_mode": 33188,
      "new_path": "net/netfilter/nft_set_pipapo.c"
    }
  ]
}