From: Zhengyang Chen When XT_TIME_CONTIGUOUS handles a cross-day daytime range, packets in the post-midnight part of the range are matched against the previous calendar day by subtracting SECONDS_PER_DAY from stamp. On the first day after the epoch, this backdating can make the signed time64_t stamp negative. localtime_2() and localtime_3() then feed the value into unsigned division helpers and derive wrapped calendar fields. In particular, monthday can become larger than the valid 1..31 range, leading time_mt() to evaluate an out-of-range 1U << current_time.monthday shift. The date_start/date_stop ABI is unsigned and cannot represent pre-epoch calendar dates. If contiguous matching backdates stamp before the epoch, only rules without weekday and monthday constraints can still be evaluated safely; reject calendar-constrained rules before converting the timestamp to calendar fields. Fixes: 54eb3df3a7d0 ("netfilter: xt_time: add support to ignore day transition") Cc: stable@vger.kernel.org Reported-by: Yuan Tan Reported-by: Xin Liu Assisted-by: Codex:gpt-5.4 Signed-off-by: Zhengyang Chen Reviewed-by: Ren Wei --- net/netfilter/xt_time.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/net/netfilter/xt_time.c b/net/netfilter/xt_time.c index 2065fce8ef81..014561a2ef3f 100644 --- a/net/netfilter/xt_time.c +++ b/net/netfilter/xt_time.c @@ -220,6 +220,15 @@ time_mt(const struct sk_buff *skb, struct xt_action_param *par) stamp -= SECONDS_PER_DAY; } + /* + * The date_start/date_stop ABI cannot express pre-epoch timestamps. + * If XT_TIME_CONTIGUOUS moves the packet into that range, only rules + * without calendar constraints can still match. + */ + if (stamp < 0) + return info->weekdays_match == XT_TIME_ALL_WEEKDAYS && + info->monthdays_match == XT_TIME_ALL_MONTHDAYS; + localtime_2(¤t_time, stamp); if (!(info->weekdays_match & (1U << current_time.weekday))) -- 2.43.0