On Tue, Dec 02, 2025 at 03:55:39PM +0000, Simon Horman wrote:
> On Wed, Nov 26, 2025 at 01:35:38PM -0600, Daniel Jurgens wrote:
>
> ...
>
> > @@ -6005,6 +6085,11 @@ static void parse_ip4(struct iphdr *mask, struct
> > iphdr *key,
> > mask->tos = l3_mask->tos;
> > key->tos = l3_val->tos;
> > }
> > +
> > + if (l3_mask->proto) {
> > + mask->protocol = l3_mask->proto;
> > + key->protocol = l3_val->proto;
> > + }
> > }
>
> Hi Daniel,
>
> Claude Code with review-prompts flags an issue here,
> which I can't convince myself is not the case.
>
> If parse_ip4() is called for a IP_USER_FLOW, which use ethtool_usrip4_spec,
> as does this function, then all is well.
>
> However, it seems that it may also be called for TCP_V4_FLOW and UDP_V4_FLOW
> flows, in which case accessing .proto will overrun the mask and key which
> are actually struct ethtool_tcpip4_spec.
>
> https://netdev-ai.bots.linux.dev/ai-review.html?id=51d97b85-5ca3-4cb8-a96a-0d6eab5e7196#patch-10
Oh I didn't know about this one. Is there any data on how does it work?
Which model/prompt/etc?
> >
> > static void parse_ip6(struct ipv6hdr *mask, struct ipv6hdr *key,
> > @@ -6022,16 +6107,35 @@ static void parse_ip6(struct ipv6hdr *mask, struct
> > ipv6hdr *key,
> > memcpy(&mask->daddr, l3_mask->ip6dst, sizeof(mask->daddr));
> > memcpy(&key->daddr, l3_val->ip6dst, sizeof(key->daddr));
> > }
> > +
> > + if (l3_mask->l4_proto) {
> > + mask->nexthdr = l3_mask->l4_proto;
> > + key->nexthdr = l3_val->l4_proto;
> > + }
>
> Likewise here.
>
> > }
>
> ...
