AI Trajectory

Trajectory: (Expand/Collapse All)
Seq	Timestamp	Type	Name	Duration
0/0	2026/08/18 14:39	flow	patch-triage	2m Args: null Results: { "EnableConfigs": [ "NETFILTER_XT_TARGET_CT", "NETFILTER_XT_TARGET_IDLETIMER", "NF_CONNTRACK", "IP_NF_RAW", "NETFILTER_ADVANCED" ], "FocusSymbols": [ "xt_ct_tg_check", "idletimer_tg_checkentry", "idletimer_tg_checkentry_v1" ], "KMSANReasoning": "The patch series primarily removes `pr_debug` statements and converts some to `pr_info_ratelimited` across various netfilter modules. There is also a logical change in `xt_CT.c` regarding the validation of `info-\u003ehelper` and `info-\u003etimeout` strings, which introduces dead code and alters the error handling for non-null-terminated strings. However, the `info` structure (`par-\u003etarginfo`) is populated via `copy_from_user` with data provided by userspace, meaning the memory is fully initialized from the kernel's perspective. The patch does not introduce any new allocations, does not expose kernel memory to userspace, and does not add control flow dependent on uninitialized kernel memory. Any bugs introduced by this patch (such as the logic flaw in `xt_CT.c`) are functional and do not involve uninitialized memory. Therefore, a dedicated KMSAN fuzzing session is not necessary.", "NeedsKMSAN": false, "Reasoning": "The patch modifies `xt_CT.c` to change the validation logic for `info-\u003ehelper` and `info-\u003etimeout`. If they are not null-terminated, the new code skips setting them instead of returning `-ENAMETOOLONG`, which is a functional change in the target initialization logic. The patch also modifies `xt_IDLETIMER.c` to release a mutex before logging, which is a minor functional change. These changes alter the execution flow and are reachable from userspace via netfilter configuration.", "WorthFuzzing": true }
1/1	2026/08/18 14:39	action	read-patch-diff	0m Args: null Results: { "PatchDiff": "commit 9338aec55ce1ed0fef018b0c87a6ae341b6a6a77\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Tue Aug 18 14:39:20 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/net/ipv4/netfilter/ipt_ah.c b/net/ipv4/netfilter/ipt_ah.c\nindex 161ba412cb08b..7131f297ada2e 100644\n--- a/net/ipv4/netfilter/ipt_ah.c\n+++ b/net/ipv4/netfilter/ipt_ah.c\n@@ -19,12 +19,7 @@ MODULE_DESCRIPTION(\"Xtables: IPv4 IPsec-AH SPI match\");\n static inline bool\n spi_match(u_int32_t min, u_int32_t max, u_int32_t spi, bool invert)\n {\n-\tbool r;\n-\tpr_debug(\"spi_match:%c 0x%x \u003c= 0x%x \u003c= 0x%x\\n\",\n-\t\t invert ? '!' : ' ', min, spi, max);\n-\tr = (spi \u003e= min \u0026\u0026 spi \u003c= max) ^ invert;\n-\tpr_debug(\" result %s\\n\", r ? \"PASS\" : \"FAILED\");\n-\treturn r;\n+\treturn (spi \u003e= min \u0026\u0026 spi \u003c= max) ^ invert;\n }\n \n static bool ah_mt(const struct sk_buff skb, struct xt_action_param par)\n@@ -42,7 +37,6 @@ static bool ah_mt(const struct sk_buff skb, struct xt_action_param par)\n \t\t/* We've been asked to examine this packet, and we\n \t\t * can't. Hence, no choice but to drop.\n \t\t /\n-\t\tpr_debug(\"Dropping evil AH tinygram.\\n\");\n \t\tpar-\u003ehotdrop = true;\n \t\treturn false;\n \t}\n@@ -58,7 +52,7 @@ static int ah_mt_check(const struct xt_mtchk_param par)\n \n \t/* Must specify no unknown invflags /\n \tif (ahinfo-\u003einvflags \u0026 ~IPT_AH_INV_MASK) {\n-\t\tpr_debug(\"unknown flags %X\\n\", ahinfo-\u003einvflags);\n+\t\tpr_info_ratelimited(\"unknown flags %X\\n\", ahinfo-\u003einvflags);\n \t\treturn -EINVAL;\n \t}\n \treturn 0;\ndiff --git a/net/ipv4/netfilter/ipt_rpfilter.c b/net/ipv4/netfilter/ipt_rpfilter.c\nindex 6d9bf51068684..2c38fd6624aa1 100644\n--- a/net/ipv4/netfilter/ipt_rpfilter.c\n+++ b/net/ipv4/netfilter/ipt_rpfilter.c\n@@ -95,8 +95,7 @@ static int rpfilter_check(const struct xt_mtchk_param par)\n \n \tif (strcmp(par-\u003etable, \"mangle\") != 0 \u0026\u0026\n \t strcmp(par-\u003etable, \"raw\") != 0) {\n-\t\tpr_info_ratelimited(\"only valid in \\'raw\\' or \\'mangle\\' table, not \\'%s\\'\\n\",\n-\t\t\t\t par-\u003etable);\n+\t\tpr_info_ratelimited(\"only valid in \\'raw\\' or \\'mangle\\' table\\n\");\n \t\treturn -EINVAL;\n \t}\n \ndiff --git a/net/ipv6/netfilter/ip6t_ah.c b/net/ipv6/netfilter/ip6t_ah.c\nindex 1258783ed8762..dab7dbc6a675c 100644\n--- a/net/ipv6/netfilter/ip6t_ah.c\n+++ b/net/ipv6/netfilter/ip6t_ah.c\n@@ -24,13 +24,7 @@ MODULE_AUTHOR(\"Andras Kis-Szabo \u003ckisza@sch.bme.hu\u003e\");\n static inline bool\n spi_match(u_int32_t min, u_int32_t max, u_int32_t spi, bool invert)\n {\n-\tbool r;\n-\n-\tpr_debug(\"spi_match:%c 0x%x \u003c= 0x%x \u003c= 0x%x\\n\",\n-\t\t invert ? '!' : ' ', min, spi, max);\n-\tr = (spi \u003e= min \u0026\u0026 spi \u003c= max) ^ invert;\n-\tpr_debug(\" result %s\\n\", r ? \"PASS\" : \"FAILED\");\n-\treturn r;\n+\treturn (spi \u003e= min \u0026\u0026 spi \u003c= max) ^ invert;\n }\n \n static bool ah_mt6(const struct sk_buff skb, struct xt_action_param par)\n@@ -62,23 +56,6 @@ static bool ah_mt6(const struct sk_buff skb, struct xt_action_param par)\n \t\treturn false;\n \t}\n \n-\tpr_debug(\"IPv6 AH LEN %u %u \", hdrlen, ah-\u003ehdrlen);\n-\tpr_debug(\"RES %04X \", ah-\u003ereserved);\n-\tpr_debug(\"SPI %u %08X\\n\", ntohl(ah-\u003espi), ntohl(ah-\u003espi));\n-\n-\tpr_debug(\"IPv6 AH spi %02X \",\n-\t\t spi_match(ahinfo-\u003espis[0], ahinfo-\u003espis[1],\n-\t\t\t ntohl(ah-\u003espi),\n-\t\t\t !!(ahinfo-\u003einvflags \u0026 IP6T_AH_INV_SPI)));\n-\tpr_debug(\"len %02X %04X %02X \",\n-\t\t ahinfo-\u003ehdrlen, hdrlen,\n-\t\t (!ahinfo-\u003ehdrlen \|\|\n-\t\t (ahinfo-\u003ehdrlen == hdrlen) ^\n-\t\t !!(ahinfo-\u003einvflags \u0026 IP6T_AH_INV_LEN)));\n-\tpr_debug(\"res %02X %04X %02X\\n\",\n-\t\t ahinfo-\u003ehdrres, ah-\u003ereserved,\n-\t\t !(ahinfo-\u003ehdrres \u0026\u0026 ah-\u003ereserved));\n-\n \treturn spi_match(ahinfo-\u003espis[0], ahinfo-\u003espis[1],\n \t\t\t ntohl(ah-\u003espi),\n \t\t\t !!(ahinfo-\u003einvflags \u0026 IP6T_AH_INV_SPI)) \u0026\u0026\n@@ -93,7 +70,7 @@ static int ah_mt6_check(const struct xt_mtchk_param par)\n \tconst struct ip6t_ah ahinfo = par-\u003ematchinfo;\n \n \tif (ahinfo-\u003einvflags \u0026 ~IP6T_AH_INV_MASK) {\n-\t\tpr_debug(\"unknown flags %X\\n\", ahinfo-\u003einvflags);\n+\t\tpr_info_ratelimited(\"unknown flags %X\\n\", ahinfo-\u003einvflags);\n \t\treturn -EINVAL;\n \t}\n \treturn 0;\ndiff --git a/net/ipv6/netfilter/ip6t_frag.c b/net/ipv6/netfilter/ip6t_frag.c\nindex 3aad6439386b1..f5f3cfb8704cf 100644\n--- a/net/ipv6/netfilter/ip6t_frag.c\n+++ b/net/ipv6/netfilter/ip6t_frag.c\n@@ -23,12 +23,7 @@ MODULE_AUTHOR(\"Andras Kis-Szabo \u003ckisza@sch.bme.hu\u003e\");\n static inline bool\n id_match(u_int32_t min, u_int32_t max, u_int32_t id, bool invert)\n {\n-\tbool r;\n-\tpr_debug(\"id_match:%c 0x%x \u003c= 0x%x \u003c= 0x%x\\n\", invert ? '!' : ' ',\n-\t\t min, id, max);\n-\tr = (id \u003e= min \u0026\u0026 id \u003c= max) ^ invert;\n-\tpr_debug(\" result %s\\n\", r ? \"PASS\" : \"FAILED\");\n-\treturn r;\n+\treturn (id \u003e= min \u0026\u0026 id \u003c= max) ^ invert;\n }\n \n static bool\n@@ -53,38 +48,6 @@ frag_mt6(const struct sk_buff skb, struct xt_action_param par)\n \t\treturn false;\n \t}\n \n-\tpr_debug(\"INFO %04X \", fh-\u003efrag_off);\n-\tpr_debug(\"OFFSET %04X \", ntohs(fh-\u003efrag_off) \u0026 ~0x7);\n-\tpr_debug(\"RES %02X %04X\", fh-\u003ereserved, ntohs(fh-\u003efrag_off) \u0026 0x6);\n-\tpr_debug(\"MF %04X \", fh-\u003efrag_off \u0026 htons(IP6_MF));\n-\tpr_debug(\"ID %u %08X\\n\", ntohl(fh-\u003eidentification),\n-\t\t ntohl(fh-\u003eidentification));\n-\n-\tpr_debug(\"IPv6 FRAG id %02X \",\n-\t\t id_match(fraginfo-\u003eids[0], fraginfo-\u003eids[1],\n-\t\t\t ntohl(fh-\u003eidentification),\n-\t\t\t !!(fraginfo-\u003einvflags \u0026 IP6T_FRAG_INV_IDS)));\n-\tpr_debug(\"res %02X %02X%04X %02X \",\n-\t\t fraginfo-\u003eflags \u0026 IP6T_FRAG_RES, fh-\u003ereserved,\n-\t\t ntohs(fh-\u003efrag_off) \u0026 0x6,\n-\t\t !((fraginfo-\u003eflags \u0026 IP6T_FRAG_RES) \u0026\u0026\n-\t\t (fh-\u003ereserved \|\| (ntohs(fh-\u003efrag_off) \u0026 0x06))));\n-\tpr_debug(\"first %02X %02X %02X \",\n-\t\t fraginfo-\u003eflags \u0026 IP6T_FRAG_FST,\n-\t\t ntohs(fh-\u003efrag_off) \u0026 ~0x7,\n-\t\t !((fraginfo-\u003eflags \u0026 IP6T_FRAG_FST) \u0026\u0026\n-\t\t (ntohs(fh-\u003efrag_off) \u0026 ~0x7)));\n-\tpr_debug(\"mf %02X %02X %02X \",\n-\t\t fraginfo-\u003eflags \u0026 IP6T_FRAG_MF,\n-\t\t ntohs(fh-\u003efrag_off) \u0026 IP6_MF,\n-\t\t !((fraginfo-\u003eflags \u0026 IP6T_FRAG_MF) \u0026\u0026\n-\t\t !((ntohs(fh-\u003efrag_off) \u0026 IP6_MF))));\n-\tpr_debug(\"last %02X %02X %02X\\n\",\n-\t\t fraginfo-\u003eflags \u0026 IP6T_FRAG_NMF,\n-\t\t ntohs(fh-\u003efrag_off) \u0026 IP6_MF,\n-\t\t !((fraginfo-\u003eflags \u0026 IP6T_FRAG_NMF) \u0026\u0026\n-\t\t (ntohs(fh-\u003efrag_off) \u0026 IP6_MF)));\n-\n \treturn id_match(fraginfo-\u003eids[0], fraginfo-\u003eids[1],\n \t\t\t ntohl(fh-\u003eidentification),\n \t\t\t !!(fraginfo-\u003einvflags \u0026 IP6T_FRAG_INV_IDS)) \u0026\u0026\n@@ -103,7 +66,7 @@ static int frag_mt6_check(const struct xt_mtchk_param par)\n \tconst struct ip6t_frag fraginfo = par-\u003ematchinfo;\n \n \tif (fraginfo-\u003einvflags \u0026 ~IP6T_FRAG_INV_MASK) {\n-\t\tpr_debug(\"unknown flags %X\\n\", fraginfo-\u003einvflags);\n+\t\tpr_info_ratelimited(\"unknown flags %X\\n\", fraginfo-\u003einvflags);\n \t\treturn -EINVAL;\n \t}\n \treturn 0;\ndiff --git a/net/ipv6/netfilter/ip6t_hbh.c b/net/ipv6/netfilter/ip6t_hbh.c\nindex 6d1a5d2026a67..37c207d3152a4 100644\n--- a/net/ipv6/netfilter/ip6t_hbh.c\n+++ b/net/ipv6/netfilter/ip6t_hbh.c\n@@ -79,14 +79,6 @@ hbh_mt6(const struct sk_buff skb, struct xt_action_param par)\n \t\treturn false;\n \t}\n \n-\tpr_debug(\"IPv6 OPTS LEN %u %u \", hdrlen, oh-\u003ehdrlen);\n-\n-\tpr_debug(\"len %02X %04X %02X \",\n-\t\t optinfo-\u003ehdrlen, hdrlen,\n-\t\t (!(optinfo-\u003eflags \u0026 IP6T_OPTS_LEN) \|\|\n-\t\t ((optinfo-\u003ehdrlen == hdrlen) ^\n-\t\t !!(optinfo-\u003einvflags \u0026 IP6T_OPTS_INV_LEN))));\n-\n \tret = (!(optinfo-\u003eflags \u0026 IP6T_OPTS_LEN) \|\|\n \t ((optinfo-\u003ehdrlen == hdrlen) ^\n \t\t!!(optinfo-\u003einvflags \u0026 IP6T_OPTS_INV_LEN)));\n@@ -96,8 +88,6 @@ hbh_mt6(const struct sk_buff skb, struct xt_action_param par)\n \tif (!(optinfo-\u003eflags \u0026 IP6T_OPTS_OPTS)) {\n \t\treturn ret;\n \t} else {\n-\t\tpr_debug(\"Strict \");\n-\t\tpr_debug(\"#%d \", optinfo-\u003eoptsnr);\n \t\tfor (temp = 0; temp \u003c optinfo-\u003eoptsnr; temp++) {\n \t\t\t/* type field exists ? /\n \t\t\tif (hdrlen \u003c 1)\n@@ -108,13 +98,9 @@ hbh_mt6(const struct sk_buff skb, struct xt_action_param par)\n \t\t\t\tbreak;\n \n \t\t\t/ Type check /\n-\t\t\tif (tp != (optinfo-\u003eopts[temp] \u0026 0xFF00) \u003e\u003e 8) {\n-\t\t\t\tpr_debug(\"Tbad %02X %02X\\n\", tp,\n-\t\t\t\t\t (optinfo-\u003eopts[temp] \u0026 0xFF00) \u003e\u003e 8);\n+\t\t\tif (tp != (optinfo-\u003eopts[temp] \u0026 0xFF00) \u003e\u003e 8)\n \t\t\t\treturn false;\n-\t\t\t} else {\n-\t\t\t\tpr_debug(\"Tok \");\n-\t\t\t}\n+\n \t\t\t/* Length check /\n \t\t\tif (tp) {\n \t\t\t\tu16 spec_len;\n@@ -129,26 +115,18 @@ hbh_mt6(const struct sk_buff skb, struct xt_action_param par)\n \t\t\t\t\tbreak;\n \t\t\t\tspec_len = optinfo-\u003eopts[temp] \u0026 0x00FF;\n \n-\t\t\t\tif (spec_len != 0x00FF \u0026\u0026 spec_len != lp) {\n-\t\t\t\t\tpr_debug(\"Lbad %02X %04X\\n\", lp,\n-\t\t\t\t\t\t spec_len);\n+\t\t\t\tif (spec_len != 0x00FF \u0026\u0026 spec_len != lp)\n \t\t\t\t\treturn false;\n-\t\t\t\t}\n-\t\t\t\tpr_debug(\"Lok \");\n+\n \t\t\t\toptlen = lp + 2;\n \t\t\t} else {\n-\t\t\t\tpr_debug(\"Pad1\\n\");\n \t\t\t\toptlen = 1;\n \t\t\t}\n \n-\t\t\t/* Step to the next /\n-\t\t\tpr_debug(\"len%04X\\n\", optlen);\n-\n \t\t\tif ((ptr \u003e skb-\u003elen - optlen \|\| hdrlen \u003c optlen) \u0026\u0026\n-\t\t\t temp \u003c optinfo-\u003eoptsnr - 1) {\n-\t\t\t\tpr_debug(\"new pointer is too large!\\n\");\n+\t\t\t temp \u003c optinfo-\u003eoptsnr - 1)\n \t\t\t\tbreak;\n-\t\t\t}\n+\n \t\t\tptr += optlen;\n \t\t\thdrlen -= optlen;\n \t\t}\n@@ -166,16 +144,16 @@ static int hbh_mt6_check(const struct xt_mtchk_param par)\n \tconst struct ip6t_opts optsinfo = par-\u003ematchinfo;\n \n \tif (optsinfo-\u003einvflags \u0026 ~IP6T_OPTS_INV_MASK) {\n-\t\tpr_debug(\"unknown flags %X\\n\", optsinfo-\u003einvflags);\n+\t\tpr_info_ratelimited(\"unknown flags %X\\n\", optsinfo-\u003einvflags);\n \t\treturn -EINVAL;\n \t}\n \tif (optsinfo-\u003eoptsnr \u003e IP6T_OPTS_OPTSNR) {\n-\t\tpr_debug(\"too many supported opts specified\\n\");\n+\t\tpr_info_ratelimited(\"too many supported opts specified\\n\");\n \t\treturn -EINVAL;\n \t}\n \n \tif (optsinfo-\u003eflags \u0026 IP6T_OPTS_NSTRICT) {\n-\t\tpr_debug(\"Not strict - not implemented\");\n+\t\tpr_info_ratelimited(\"Not strict - not implemented\");\n \t\treturn -EINVAL;\n \t}\n \ndiff --git a/net/ipv6/netfilter/ip6t_mh.c b/net/ipv6/netfilter/ip6t_mh.c\nindex fd492b69acbc0..ba6dcc7791a09 100644\n--- a/net/ipv6/netfilter/ip6t_mh.c\n+++ b/net/ipv6/netfilter/ip6t_mh.c\n@@ -42,14 +42,11 @@ static bool mh_mt6(const struct sk_buff skb, struct xt_action_param par)\n \tif (mh == NULL) {\n \t\t/ We've been asked to examine this packet, and we\n \t\t can't. Hence, no choice but to drop. /\n-\t\tpr_debug(\"Dropping evil MH tinygram.\\n\");\n \t\tpar-\u003ehotdrop = true;\n \t\treturn false;\n \t}\n \n \tif (mh-\u003eip6mh_proto != IPPROTO_NONE) {\n-\t\tpr_debug(\"Dropping invalid MH Payload Proto: %u\\n\",\n-\t\t\t mh-\u003eip6mh_proto);\n \t\tpar-\u003ehotdrop = true;\n \t\treturn false;\n \t}\ndiff --git a/net/ipv6/netfilter/ip6t_rpfilter.c b/net/ipv6/netfilter/ip6t_rpfilter.c\nindex 67c87a88cde4f..af8d10d49de81 100644\n--- a/net/ipv6/netfilter/ip6t_rpfilter.c\n+++ b/net/ipv6/netfilter/ip6t_rpfilter.c\n@@ -118,7 +118,7 @@ static int rpfilter_check(const struct xt_mtchk_param par)\n \n \tif (strcmp(par-\u003etable, \"mangle\") != 0 \u0026\u0026\n \t strcmp(par-\u003etable, \"raw\") != 0) {\n-\t\tpr_info_ratelimited(\"only valid in \\'raw\\' or \\'mangle\\' table, not \\'%s\\'\\n\",\n+\t\tpr_info_ratelimited(\"only valid in \\'raw\\' or \\'mangle\\' table\\n\",\n \t\t\t\t par-\u003etable);\n \t\treturn -EINVAL;\n \t}\ndiff --git a/net/ipv6/netfilter/ip6t_rt.c b/net/ipv6/netfilter/ip6t_rt.c\nindex 278b52752f364..0c01ac2746d1f 100644\n--- a/net/ipv6/netfilter/ip6t_rt.c\n+++ b/net/ipv6/netfilter/ip6t_rt.c\n@@ -155,18 +155,18 @@ static int rt_mt6_check(const struct xt_mtchk_param par)\n \tconst struct ip6t_rt rtinfo = par-\u003ematchinfo;\n \n \tif (rtinfo-\u003einvflags \u0026 ~IP6T_RT_INV_MASK) {\n-\t\tpr_debug(\"unknown flags %X\\n\", rtinfo-\u003einvflags);\n+\t\tpr_info_ratelimited(\"unknown flags %X\\n\", rtinfo-\u003einvflags);\n \t\treturn -EINVAL;\n \t}\n \tif (rtinfo-\u003eaddrnr \u003e IP6T_RT_HOPS) {\n-\t\tpr_debug(\"too many addresses specified\\n\");\n+\t\tpr_info_ratelimited(\"too many addresses specified\\n\");\n \t\treturn -EINVAL;\n \t}\n \tif ((rtinfo-\u003eflags \u0026 (IP6T_RT_RES \| IP6T_RT_FST_MASK)) \u0026\u0026\n \t (!(rtinfo-\u003eflags \u0026 IP6T_RT_TYP) \|\|\n \t (rtinfo-\u003ert_type != 0) \|\|\n \t (rtinfo-\u003einvflags \u0026 IP6T_RT_INV_TYP))) {\n-\t\tpr_debug(\"`--rt-type 0' required before `--rt-0-'\");\n+\t\tpr_info_ratelimited(\"`--rt-type 0' required before `--rt-0-'\");\n \t\treturn -EINVAL;\n \t}\n \ndiff --git a/net/netfilter/xt_CONNSECMARK.c b/net/netfilter/xt_CONNSECMARK.c\nindex 1494b3ee30e11..4e4436a9104b4 100644\n--- a/net/netfilter/xt_CONNSECMARK.c\n+++ b/net/netfilter/xt_CONNSECMARK.c\n@@ -87,8 +87,7 @@ static int connsecmark_tg_check(const struct xt_tgchk_param par)\n \n \tif (strcmp(par-\u003etable, \"mangle\") != 0 \u0026\u0026\n \t strcmp(par-\u003etable, \"security\") != 0) {\n-\t\tpr_info_ratelimited(\"only valid in \\'mangle\\' or \\'security\\' table, not \\'%s\\'\\n\",\n-\t\t\t\t par-\u003etable);\n+\t\tpr_info_ratelimited(\"only valid in \\'mangle\\' or \\'security\\' table\\n\");\n \t\treturn -EINVAL;\n \t}\n \ndiff --git a/net/netfilter/xt_CT.c b/net/netfilter/xt_CT.c\nindex e78660dfdf4b6..91326014ade1c 100644\n--- a/net/netfilter/xt_CT.c\n+++ b/net/netfilter/xt_CT.c\n@@ -195,7 +195,8 @@ static int xt_ct_tg_check(const struct xt_tgchk_param par,\n \t\tgoto err3;\n \t}\n \n-\tif (info-\u003ehelper[0]) {\n+\tif (info-\u003ehelper[0] \u0026\u0026\n+\t strnlen(info-\u003ehelper, sizeof(info-\u003ehelper)) \u003c sizeof(info-\u003ehelper)) {\n \t\tif (strnlen(info-\u003ehelper, sizeof(info-\u003ehelper)) == sizeof(info-\u003ehelper)) {\n \t\t\tret = -ENAMETOOLONG;\n \t\t\tgoto err3;\n@@ -206,7 +207,8 @@ static int xt_ct_tg_check(const struct xt_tgchk_param par,\n \t\t\tgoto err3;\n \t}\n \n-\tif (info-\u003etimeout[0]) {\n+\tif (info-\u003etimeout[0] \u0026\u0026\n+\t strnlen(info-\u003etimeout, sizeof(info-\u003etimeout)) \u003c sizeof(info-\u003etimeout)) {\n \t\tif (strnlen(info-\u003etimeout, sizeof(info-\u003etimeout)) == sizeof(info-\u003etimeout)) {\n \t\t\tret = -ENAMETOOLONG;\n \t\t\tgoto err4;\ndiff --git a/net/netfilter/xt_IDLETIMER.c b/net/netfilter/xt_IDLETIMER.c\nindex bfcf2d44e93db..15b698ea98aa6 100644\n--- a/net/netfilter/xt_IDLETIMER.c\n+++ b/net/netfilter/xt_IDLETIMER.c\n@@ -102,8 +102,6 @@ static void idletimer_tg_expired(struct timer_list t)\n {\n \tstruct idletimer_tg timer = timer_container_of(timer, t, timer);\n \n-\tpr_debug(\"timer %s expired\\n\", timer-\u003eattr.attr.name);\n-\n \tschedule_work(\u0026timer-\u003ework);\n }\n \n@@ -111,7 +109,6 @@ static void idletimer_tg_alarmproc(struct alarm alarm, ktime_t now)\n {\n \tstruct idletimer_tg timer = alarm-\u003edata;\n \n-\tpr_debug(\"alarm %s expired\\n\", timer-\u003eattr.attr.name);\n \tschedule_work(\u0026timer-\u003ework);\n }\n \n@@ -171,7 +168,7 @@ static int idletimer_tg_create(struct idletimer_tg_info info)\n \n \tret = sysfs_create_file(idletimer_tg_kobj, \u0026info-\u003etimer-\u003eattr.attr);\n \tif (ret \u003c 0) {\n-\t\tpr_debug(\"couldn't add file to sysfs\");\n+\t\tpr_info_ratelimited(\"couldn't add file to sysfs\");\n \t\tgoto out_free_attr;\n \t}\n \n@@ -220,7 +217,7 @@ static int idletimer_tg_create_v1(struct idletimer_tg_info_v1 info)\n \n \tret = sysfs_create_file(idletimer_tg_kobj, \u0026info-\u003etimer-\u003eattr.attr);\n \tif (ret \u003c 0) {\n-\t\tpr_debug(\"couldn't add file to sysfs\");\n+\t\tpr_info_ratelimited(\"couldn't add file to sysfs\");\n \t\tgoto out_free_attr;\n \t}\n \n@@ -228,7 +225,6 @@ static int idletimer_tg_create_v1(struct idletimer_tg_info_v1 info)\n \tkobject_uevent(idletimer_tg_kobj,KOBJ_ADD);\n \n \tlist_add(\u0026info-\u003etimer-\u003eentry, \u0026idletimer_tg_list);\n-\tpr_debug(\"timer type value is %u\", info-\u003etimer_type);\n \tinfo-\u003etimer-\u003etimer_type = info-\u003etimer_type;\n \tinfo-\u003etimer-\u003erefcnt = 1;\n \n@@ -263,9 +259,6 @@ static unsigned int idletimer_tg_target(struct sk_buff skb,\n {\n \tconst struct idletimer_tg_info info = par-\u003etarginfo;\n \n-\tpr_debug(\"resetting timer %s, timeout period %u\\n\",\n-\t\t info-\u003elabel, info-\u003etimeout);\n-\n \tmod_timer(\u0026info-\u003etimer-\u003etimer,\n \t\t secs_to_jiffies(info-\u003etimeout) + jiffies);\n \n@@ -280,9 +273,6 @@ static unsigned int idletimer_tg_target_v1(struct sk_buff skb,\n {\n \tconst struct idletimer_tg_info_v1 info = par-\u003etarginfo;\n \n-\tpr_debug(\"resetting timer %s, timeout period %u\\n\",\n-\t\t info-\u003elabel, info-\u003etimeout);\n-\n \tif (info-\u003etimer-\u003etimer_type \u0026 XT_IDLETIMER_ALARM) {\n \t\tidletimer_start_alarm_sec(info-\u003etimer, info-\u003etimeout);\n \t} else {\n@@ -296,17 +286,17 @@ static unsigned int idletimer_tg_target_v1(struct sk_buff skb,\n static int idletimer_tg_helper(struct idletimer_tg_info info)\n {\n \tif (info-\u003etimeout == 0) {\n-\t\tpr_debug(\"timeout value is zero\\n\");\n+\t\tpr_info_ratelimited(\"timeout value is zero\\n\");\n \t\treturn -EINVAL;\n \t}\n \tif (info-\u003etimeout \u003e= INT_MAX / 1000) {\n-\t\tpr_debug(\"timeout value is too big\\n\");\n+\t\tpr_info_ratelimited(\"timeout value is too big\\n\");\n \t\treturn -EINVAL;\n \t}\n \tif (info-\u003elabel[0] == '\\0' \|\|\n \t strnlen(info-\u003elabel,\n \t\t MAX_IDLETIMER_LABEL_SIZE) == MAX_IDLETIMER_LABEL_SIZE) {\n-\t\tpr_debug(\"label is empty or not nul-terminated\\n\");\n+\t\tpr_info_ratelimited(\"label is empty or not nul-terminated\\n\");\n \t\treturn -EINVAL;\n \t}\n \treturn 0;\n@@ -318,34 +308,25 @@ static int idletimer_tg_checkentry(const struct xt_tgchk_param par)\n \tstruct idletimer_tg_info info = par-\u003etarginfo;\n \tint ret;\n \n-\tpr_debug(\"checkentry targinfo%s\\n\", info-\u003elabel);\n-\n \tret = idletimer_tg_helper(info);\n \tif(ret \u003c 0)\n-\t{\n-\t\tpr_debug(\"checkentry helper return invalid\\n\");\n \t\treturn -EINVAL;\n-\t}\n \tmutex_lock(\u0026list_mutex);\n \n \tinfo-\u003etimer = __idletimer_tg_find_by_label(info-\u003elabel);\n \tif (info-\u003etimer) {\n \t\tif (info-\u003etimer-\u003etimer_type \u0026 XT_IDLETIMER_ALARM) {\n-\t\t\tpr_debug(\"Adding/Replacing rule with same label and different timer type is not allowed\\n\");\n \t\t\tmutex_unlock(\u0026list_mutex);\n+\t\t\tpr_info_ratelimited(\"Adding/Replacing rule with same label and different timer type is not allowed\\n\");\n \t\t\treturn -EINVAL;\n \t\t}\n \n \t\tinfo-\u003etimer-\u003erefcnt++;\n \t\tmod_timer(\u0026info-\u003etimer-\u003etimer,\n \t\t\t secs_to_jiffies(info-\u003etimeout) + jiffies);\n-\n-\t\tpr_debug(\"increased refcnt of timer %s to %u\\n\",\n-\t\t\t info-\u003elabel, info-\u003etimer-\u003erefcnt);\n \t} else {\n \t\tret = idletimer_tg_create(info);\n \t\tif (ret \u003c 0) {\n-\t\t\tpr_debug(\"failed to create timer\\n\");\n \t\t\tmutex_unlock(\u0026list_mutex);\n \t\t\treturn ret;\n \t\t}\n@@ -360,30 +341,23 @@ static int idletimer_tg_checkentry_v1(const struct xt_tgchk_param par)\n \tstruct idletimer_tg_info_v1 info = par-\u003etarginfo;\n \tint ret;\n \n-\tpr_debug(\"checkentry targinfo%s\\n\", info-\u003elabel);\n-\n \tif (info-\u003esend_nl_msg)\n \t\treturn -EOPNOTSUPP;\n \n \tret = idletimer_tg_helper((struct idletimer_tg_info )info);\n \tif(ret \u003c 0)\n-\t{\n-\t\tpr_debug(\"checkentry helper return invalid\\n\");\n \t\treturn -EINVAL;\n-\t}\n \n-\tif (info-\u003etimer_type \u003e XT_IDLETIMER_ALARM) {\n-\t\tpr_debug(\"invalid value for timer type\\n\");\n+\tif (info-\u003etimer_type \u003e XT_IDLETIMER_ALARM)\n \t\treturn -EINVAL;\n-\t}\n \n \tmutex_lock(\u0026list_mutex);\n \n \tinfo-\u003etimer = __idletimer_tg_find_by_label(info-\u003elabel);\n \tif (info-\u003etimer) {\n \t\tif (info-\u003etimer-\u003etimer_type != info-\u003etimer_type) {\n-\t\t\tpr_debug(\"Adding/Replacing rule with same label and different timer type is not allowed\\n\");\n \t\t\tmutex_unlock(\u0026list_mutex);\n+\t\t\tpr_info_ratelimited(\"Adding/Replacing rule with same label and different timer type is not allowed\\n\");\n \t\t\treturn -EINVAL;\n \t\t}\n \n@@ -393,21 +367,15 @@ static int idletimer_tg_checkentry_v1(const struct xt_tgchk_param par)\n \t\t\tktime_t tout = alarm_expires_remaining(\u0026info-\u003etimer-\u003ealarm);\n \t\t\tstruct timespec64 ktimespec = ktime_to_timespec64(tout);\n \n-\t\t\tif (ktimespec.tv_sec \u003e 0) {\n-\t\t\t\tpr_debug(\"time_expiry_remaining %lld\\n\",\n-\t\t\t\t\t ktimespec.tv_sec);\n+\t\t\tif (ktimespec.tv_sec \u003e 0)\n \t\t\t\tidletimer_start_alarm_ktime(info-\u003etimer, tout);\n-\t\t\t}\n \t\t} else {\n \t\t\t\tmod_timer(\u0026info-\u003etimer-\u003etimer,\n \t\t\t\t\tsecs_to_jiffies(info-\u003etimeout) + jiffies);\n \t\t}\n-\t\tpr_debug(\"increased refcnt of timer %s to %u\\n\",\n-\t\t\t info-\u003elabel, info-\u003etimer-\u003erefcnt);\n \t} else {\n \t\tret = idletimer_tg_create_v1(info);\n \t\tif (ret \u003c 0) {\n-\t\t\tpr_debug(\"failed to create timer\\n\");\n \t\t\tmutex_unlock(\u0026list_mutex);\n \t\t\treturn ret;\n \t\t}\n@@ -421,19 +389,13 @@ static void idletimer_tg_destroy(const struct xt_tgdtor_param par)\n {\n \tconst struct idletimer_tg_info info = par-\u003etarginfo;\n \n-\tpr_debug(\"destroy targinfo %s\\n\", info-\u003elabel);\n-\n \tmutex_lock(\u0026list_mutex);\n \n \tif (--info-\u003etimer-\u003erefcnt \u003e 0) {\n-\t\tpr_debug(\"decreased refcnt of timer %s to %u\\n\",\n-\t\t\t info-\u003elabel, info-\u003etimer-\u003erefcnt);\n \t\tmutex_unlock(\u0026list_mutex);\n \t\treturn;\n \t}\n \n-\tpr_debug(\"deleting timer %s\\n\", info-\u003elabel);\n-\n \tlist_del(\u0026info-\u003etimer-\u003eentry);\n \tmutex_unlock(\u0026list_mutex);\n \n@@ -448,19 +410,13 @@ static void idletimer_tg_destroy_v1(const struct xt_tgdtor_param par)\n {\n \tconst struct idletimer_tg_info_v1 info = par-\u003etarginfo;\n \n-\tpr_debug(\"destroy targinfo %s\\n\", info-\u003elabel);\n-\n \tmutex_lock(\u0026list_mutex);\n \n \tif (--info-\u003etimer-\u003erefcnt \u003e 0) {\n-\t\tpr_debug(\"decreased refcnt of timer %s to %u\\n\",\n-\t\t\t info-\u003elabel, info-\u003etimer-\u003erefcnt);\n \t\tmutex_unlock(\u0026list_mutex);\n \t\treturn;\n \t}\n \n-\tpr_debug(\"deleting timer %s\\n\", info-\u003elabel);\n-\n \tlist_del(\u0026info-\u003etimer-\u003eentry);\n \tmutex_unlock(\u0026list_mutex);\n \n@@ -534,7 +490,7 @@ static int __init idletimer_tg_init(void)\n \tidletimer_tg_class = class_create(\"xt_idletimer\");\n \terr = PTR_ERR(idletimer_tg_class);\n \tif (IS_ERR(idletimer_tg_class)) {\n-\t\tpr_debug(\"couldn't register device class\\n\");\n+\t\tpr_info_ratelimited(\"couldn't register device class\\n\");\n \t\tgoto out;\n \t}\n \n@@ -542,7 +498,7 @@ static int __init idletimer_tg_init(void)\n \t\t\t\t\t MKDEV(0, 0), NULL, \"timers\");\n \terr = PTR_ERR(idletimer_tg_device);\n \tif (IS_ERR(idletimer_tg_device)) {\n-\t\tpr_debug(\"couldn't register system device\\n\");\n+\t\tpr_info_ratelimited(\"couldn't register system device\\n\");\n \t\tgoto out_class;\n \t}\n \n@@ -551,7 +507,7 @@ static int __init idletimer_tg_init(void)\n \terr = xt_register_targets(idletimer_tg, ARRAY_SIZE(idletimer_tg));\n \n \tif (err \u003c 0) {\n-\t\tpr_debug(\"couldn't register xt target\\n\");\n+\t\tpr_info_ratelimited(\"couldn't register xt target\\n\");\n \t\tgoto out_dev;\n \t}\n \ndiff --git a/net/netfilter/xt_LOG.c b/net/netfilter/xt_LOG.c\nindex f39244f9c0ed9..de3f176792a07 100644\n--- a/net/netfilter/xt_LOG.c\n+++ b/net/netfilter/xt_LOG.c\n@@ -50,12 +50,12 @@ static int log_tg_check(const struct xt_tgchk_param par)\n \t\treturn -EINVAL;\n \n \tif (loginfo-\u003elevel \u003e= 8) {\n-\t\tpr_debug(\"level %u \u003e= 8\\n\", loginfo-\u003elevel);\n+\t\tpr_info_ratelimited(\"level %u \u003e= 8\\n\", loginfo-\u003elevel);\n \t\treturn -EINVAL;\n \t}\n \n \tif (loginfo-\u003eprefix[sizeof(loginfo-\u003eprefix)-1] != '\\0') {\n-\t\tpr_debug(\"prefix is not null-terminated\\n\");\n+\t\tpr_info_ratelimited(\"prefix is not null-terminated\\n\");\n \t\treturn -EINVAL;\n \t}\n \ndiff --git a/net/netfilter/xt_MASQUERADE.c b/net/netfilter/xt_MASQUERADE.c\nindex eae05c1783367..cea488cec5445 100644\n--- a/net/netfilter/xt_MASQUERADE.c\n+++ b/net/netfilter/xt_MASQUERADE.c\n@@ -21,11 +21,11 @@ static int masquerade_tg_check(const struct xt_tgchk_param par)\n \tconst struct nf_nat_ipv4_multi_range_compat mr = par-\u003etarginfo;\n \n \tif (mr-\u003erange[0].flags \u0026 NF_NAT_RANGE_MAP_IPS) {\n-\t\tpr_debug(\"bad MAP_IPS.\\n\");\n+\t\tpr_info_ratelimited(\"bad MAP_IPS.\\n\");\n \t\treturn -EINVAL;\n \t}\n \tif (mr-\u003erangesize != 1) {\n-\t\tpr_debug(\"bad rangesize %u\\n\", mr-\u003erangesize);\n+\t\tpr_info_ratelimited(\"bad rangesize %u\\n\", mr-\u003erangesize);\n \t\treturn -EINVAL;\n \t}\n \treturn nf_ct_netns_get(par-\u003enet, par-\u003efamily);\ndiff --git a/net/netfilter/xt_NETMAP.c b/net/netfilter/xt_NETMAP.c\nindex cb2ee80d84fa8..8c86d9a43373a 100644\n--- a/net/netfilter/xt_NETMAP.c\n+++ b/net/netfilter/xt_NETMAP.c\n@@ -106,11 +106,11 @@ static int netmap_tg4_check(const struct xt_tgchk_param par)\n \tconst struct nf_nat_ipv4_multi_range_compat mr = par-\u003etarginfo;\n \n \tif (!(mr-\u003erange[0].flags \u0026 NF_NAT_RANGE_MAP_IPS)) {\n-\t\tpr_debug(\"bad MAP_IPS.\\n\");\n+\t\tpr_info_ratelimited(\"bad MAP_IPS.\\n\");\n \t\treturn -EINVAL;\n \t}\n \tif (mr-\u003erangesize != 1) {\n-\t\tpr_debug(\"bad rangesize %u.\\n\", mr-\u003erangesize);\n+\t\tpr_info_ratelimited(\"bad rangesize %u.\\n\", mr-\u003erangesize);\n \t\treturn -EINVAL;\n \t}\n \treturn nf_ct_netns_get(par-\u003enet, par-\u003efamily);\ndiff --git a/net/netfilter/xt_REDIRECT.c b/net/netfilter/xt_REDIRECT.c\nindex ff66b56a3f97d..27bc0545c4f74 100644\n--- a/net/netfilter/xt_REDIRECT.c\n+++ b/net/netfilter/xt_REDIRECT.c\n@@ -51,11 +51,11 @@ static int redirect_tg4_check(const struct xt_tgchk_param par)\n \tconst struct nf_nat_ipv4_multi_range_compat mr = par-\u003etarginfo;\n \n \tif (mr-\u003erange[0].flags \u0026 NF_NAT_RANGE_MAP_IPS) {\n-\t\tpr_debug(\"bad MAP_IPS.\\n\");\n+\t\tpr_info_ratelimited(\"bad MAP_IPS.\\n\");\n \t\treturn -EINVAL;\n \t}\n \tif (mr-\u003erangesize != 1) {\n-\t\tpr_debug(\"bad rangesize %u.\\n\", mr-\u003erangesize);\n+\t\tpr_info_ratelimited(\"bad rangesize %u.\\n\", mr-\u003erangesize);\n \t\treturn -EINVAL;\n \t}\n \treturn nf_ct_netns_get(par-\u003enet, par-\u003efamily);\ndiff --git a/net/netfilter/xt_SECMARK.c b/net/netfilter/xt_SECMARK.c\nindex 5bc5ea505eb9e..38e8e410b4e81 100644\n--- a/net/netfilter/xt_SECMARK.c\n+++ b/net/netfilter/xt_SECMARK.c\n@@ -79,8 +79,7 @@ secmark_tg_check(const char table, struct xt_secmark_target_info_v1 info)\n \n \tif (strcmp(table, \"mangle\") != 0 \u0026\u0026\n \t strcmp(table, \"security\") != 0) {\n-\t\tpr_info_ratelimited(\"only valid in \\'mangle\\' or \\'security\\' table, not \\'%s\\'\\n\",\n-\t\t\t\t table);\n+\t\tpr_info_ratelimited(\"only valid in \\'mangle\\' or \\'security\\' table\\n\");\n \t\treturn -EINVAL;\n \t}\n \ndiff --git a/net/netfilter/xt_cgroup.c b/net/netfilter/xt_cgroup.c\nindex 43d2ae2be628d..ac1b7e71cd7f5 100644\n--- a/net/netfilter/xt_cgroup.c\n+++ b/net/netfilter/xt_cgroup.c\n@@ -33,7 +33,7 @@ static int cgroup_mt_check_v0(const struct xt_mtchk_param par)\n \t\treturn -EINVAL;\n \n \tif (!IS_ENABLED(CONFIG_CGROUP_NET_CLASSID)) {\n-\t\tpr_info(NET_CLS_CLASSID_INVALID_MSG);\n+\t\tpr_info_ratelimited(NET_CLS_CLASSID_INVALID_MSG);\n \t\treturn -EINVAL;\n \t}\n \n@@ -49,7 +49,7 @@ static int cgroup_mt_check_v1(const struct xt_mtchk_param par)\n \t\treturn -EINVAL;\n \n \tif (!info-\u003ehas_path \u0026\u0026 !info-\u003ehas_classid) {\n-\t\tpr_info(\"xt_cgroup: no path or classid specified\\n\");\n+\t\tpr_info_ratelimited(\"xt_cgroup: no path or classid specified\\n\");\n \t\treturn -EINVAL;\n \t}\n \n@@ -59,7 +59,7 @@ static int cgroup_mt_check_v1(const struct xt_mtchk_param par)\n \t}\n \n \tif (info-\u003ehas_classid \u0026\u0026 !IS_ENABLED(CONFIG_CGROUP_NET_CLASSID)) {\n-\t\tpr_info(NET_CLS_CLASSID_INVALID_MSG);\n+\t\tpr_info_ratelimited(NET_CLS_CLASSID_INVALID_MSG);\n \t\treturn -EINVAL;\n \t}\n \n@@ -89,7 +89,7 @@ static int cgroup_mt_check_v2(const struct xt_mtchk_param par)\n \t\treturn -EINVAL;\n \n \tif (!info-\u003ehas_path \u0026\u0026 !info-\u003ehas_classid) {\n-\t\tpr_info(\"xt_cgroup: no path or classid specified\\n\");\n+\t\tpr_info_ratelimited(\"xt_cgroup: no path or classid specified\\n\");\n \t\treturn -EINVAL;\n \t}\n \n@@ -99,7 +99,7 @@ static int cgroup_mt_check_v2(const struct xt_mtchk_param par)\n \t}\n \n \tif (info-\u003ehas_classid \u0026\u0026 !IS_ENABLED(CONFIG_CGROUP_NET_CLASSID)) {\n-\t\tpr_info(NET_CLS_CLASSID_INVALID_MSG);\n+\t\tpr_info_ratelimited(NET_CLS_CLASSID_INVALID_MSG);\n \t\treturn -EINVAL;\n \t}\n \ndiff --git a/net/netfilter/xt_esp.c b/net/netfilter/xt_esp.c\nindex 2a1c0ad0ff079..68fd75884268a 100644\n--- a/net/netfilter/xt_esp.c\n+++ b/net/netfilter/xt_esp.c\n@@ -25,12 +25,7 @@ MODULE_ALIAS(\"ip6t_esp\");\n static inline bool\n spi_match(u_int32_t min, u_int32_t max, u_int32_t spi, bool invert)\n {\n-\tbool r;\n-\tpr_debug(\"spi_match:%c 0x%x \u003c= 0x%x \u003c= 0x%x\\n\",\n-\t\t invert ? '!' : ' ', min, spi, max);\n-\tr = (spi \u003e= min \u0026\u0026 spi \u003c= max) ^ invert;\n-\tpr_debug(\" result %s\\n\", r ? \"PASS\" : \"FAILED\");\n-\treturn r;\n+\treturn (spi \u003e= min \u0026\u0026 spi \u003c= max) ^ invert;\n }\n \n static bool esp_mt(const struct sk_buff skb, struct xt_action_param par)\n@@ -48,7 +43,6 @@ static bool esp_mt(const struct sk_buff skb, struct xt_action_param par)\n \t\t/* We've been asked to examine this packet, and we\n \t\t * can't. Hence, no choice but to drop.\n \t\t /\n-\t\tpr_debug(\"Dropping evil ESP tinygram.\\n\");\n \t\tpar-\u003ehotdrop = true;\n \t\treturn false;\n \t}\n@@ -62,7 +56,7 @@ static int esp_mt_check(const struct xt_mtchk_param par)\n \tconst struct xt_esp espinfo = par-\u003ematchinfo;\n \n \tif (espinfo-\u003einvflags \u0026 ~XT_ESP_INV_MASK) {\n-\t\tpr_debug(\"unknown flags %X\\n\", espinfo-\u003einvflags);\n+\t\tpr_info_ratelimited(\"unknown flags %X\\n\", espinfo-\u003einvflags);\n \t\treturn -EINVAL;\n \t}\n \ndiff --git a/net/netfilter/xt_ipcomp.c b/net/netfilter/xt_ipcomp.c\nindex 472da639a32e2..3299c1ea60f9e 100644\n--- a/net/netfilter/xt_ipcomp.c\n+++ b/net/netfilter/xt_ipcomp.c\n@@ -29,12 +29,7 @@ MODULE_ALIAS(\"ip6t_ipcomp\");\n static inline bool\n spi_match(u_int32_t min, u_int32_t max, u_int32_t spi, bool invert)\n {\n-\tbool r;\n-\tpr_debug(\"spi_match:%c 0x%x \u003c= 0x%x \u003c= 0x%x\\n\",\n-\t\t invert ? '!' : ' ', min, spi, max);\n-\tr = (spi \u003e= min \u0026\u0026 spi \u003c= max) ^ invert;\n-\tpr_debug(\" result %s\\n\", r ? \"PASS\" : \"FAILED\");\n-\treturn r;\n+\treturn (spi \u003e= min \u0026\u0026 spi \u003c= max) ^ invert;\n }\n \n static bool comp_mt(const struct sk_buff skb, struct xt_action_param par)\n@@ -52,7 +47,6 @@ static bool comp_mt(const struct sk_buff skb, struct xt_action_param par)\n \t\t/ We've been asked to examine this packet, and we\n \t\t * can't. Hence, no choice but to drop.\n \t\t /\n-\t\tpr_debug(\"Dropping evil IPComp tinygram.\\n\");\n \t\tpar-\u003ehotdrop = true;\n \t\treturn false;\n \t}\ndiff --git a/net/netfilter/xt_iprange.c b/net/netfilter/xt_iprange.c\nindex 0c9e014e30b49..bf61141fb7850 100644\n--- a/net/netfilter/xt_iprange.c\n+++ b/net/netfilter/xt_iprange.c\n@@ -24,27 +24,15 @@ iprange_mt4(const struct sk_buff skb, struct xt_action_param par)\n \t\tm = ntohl(iph-\u003esaddr) \u003c ntohl(info-\u003esrc_min.ip);\n \t\tm \|= ntohl(iph-\u003esaddr) \u003e ntohl(info-\u003esrc_max.ip);\n \t\tm ^= !!(info-\u003eflags \u0026 IPRANGE_SRC_INV);\n-\t\tif (m) {\n-\t\t\tpr_debug(\"src IP %pI4 NOT in range %s%pI4-%pI4\\n\",\n-\t\t\t \u0026iph-\u003esaddr,\n-\t\t\t (info-\u003eflags \u0026 IPRANGE_SRC_INV) ? \"(INV) \" : \"\",\n-\t\t\t \u0026info-\u003esrc_min.ip,\n-\t\t\t \u0026info-\u003esrc_max.ip);\n+\t\tif (m)\n \t\t\treturn false;\n-\t\t}\n \t}\n \tif (info-\u003eflags \u0026 IPRANGE_DST) {\n \t\tm = ntohl(iph-\u003edaddr) \u003c ntohl(info-\u003edst_min.ip);\n \t\tm \|= ntohl(iph-\u003edaddr) \u003e ntohl(info-\u003edst_max.ip);\n \t\tm ^= !!(info-\u003eflags \u0026 IPRANGE_DST_INV);\n-\t\tif (m) {\n-\t\t\tpr_debug(\"dst IP %pI4 NOT in range %s%pI4-%pI4\\n\",\n-\t\t\t \u0026iph-\u003edaddr,\n-\t\t\t (info-\u003eflags \u0026 IPRANGE_DST_INV) ? \"(INV) \" : \"\",\n-\t\t\t \u0026info-\u003edst_min.ip,\n-\t\t\t \u0026info-\u003edst_max.ip);\n+\t\tif (m)\n \t\t\treturn false;\n-\t\t}\n \t}\n \treturn true;\n }\n@@ -73,27 +61,15 @@ iprange_mt6(const struct sk_buff skb, struct xt_action_param par)\n \t\tm = iprange_ipv6_lt(\u0026iph-\u003esaddr, \u0026info-\u003esrc_min.in6);\n \t\tm \|= iprange_ipv6_lt(\u0026info-\u003esrc_max.in6, \u0026iph-\u003esaddr);\n \t\tm ^= !!(info-\u003eflags \u0026 IPRANGE_SRC_INV);\n-\t\tif (m) {\n-\t\t\tpr_debug(\"src IP %pI6 NOT in range %s%pI6-%pI6\\n\",\n-\t\t\t\t \u0026iph-\u003esaddr,\n-\t\t\t\t (info-\u003eflags \u0026 IPRANGE_SRC_INV) ? \"(INV) \" : \"\",\n-\t\t\t\t \u0026info-\u003esrc_min.in6,\n-\t\t\t\t \u0026info-\u003esrc_max.in6);\n+\t\tif (m)\n \t\t\treturn false;\n-\t\t}\n \t}\n \tif (info-\u003eflags \u0026 IPRANGE_DST) {\n \t\tm = iprange_ipv6_lt(\u0026iph-\u003edaddr, \u0026info-\u003edst_min.in6);\n \t\tm \|= iprange_ipv6_lt(\u0026info-\u003edst_max.in6, \u0026iph-\u003edaddr);\n \t\tm ^= !!(info-\u003eflags \u0026 IPRANGE_DST_INV);\n-\t\tif (m) {\n-\t\t\tpr_debug(\"dst IP %pI6 NOT in range %s%pI6-%pI6\\n\",\n-\t\t\t\t \u0026iph-\u003edaddr,\n-\t\t\t\t (info-\u003eflags \u0026 IPRANGE_DST_INV) ? \"(INV) \" : \"\",\n-\t\t\t\t \u0026info-\u003edst_min.in6,\n-\t\t\t\t \u0026info-\u003edst_max.in6);\n+\t\tif (m)\n \t\t\treturn false;\n-\t\t}\n \t}\n \treturn true;\n }\ndiff --git a/net/netfilter/xt_ipvs.c b/net/netfilter/xt_ipvs.c\nindex 253c71cc9a634..e13c0ffb73a9a 100644\n--- a/net/netfilter/xt_ipvs.c\n+++ b/net/netfilter/xt_ipvs.c\n@@ -148,7 +148,6 @@ ipvs_mt(const struct sk_buff skb, struct xt_action_param par)\n out_put_cp:\n \t__ip_vs_conn_put(cp);\n out:\n-\tpr_debug(\"match=%d\\n\", match);\n \treturn match;\n }\n \ndiff --git a/net/netfilter/xt_multiport.c b/net/netfilter/xt_multiport.c\nindex a1691ff405d3c..bff5f53a9befb 100644\n--- a/net/netfilter/xt_multiport.c\n+++ b/net/netfilter/xt_multiport.c\n@@ -37,7 +37,6 @@ ports_match_v1(const struct xt_multiport_v1 minfo,\n \t\tif (minfo-\u003epflags[i]) {\n \t\t\t/* range port matching /\n \t\t\te = minfo-\u003eports[++i];\n-\t\t\tpr_debug(\"src or dst matches with %d-%d?\\n\", s, e);\n \n \t\t\tswitch (minfo-\u003eflags) {\n \t\t\tcase XT_MULTIPORT_SOURCE:\n@@ -58,8 +57,6 @@ ports_match_v1(const struct xt_multiport_v1 minfo,\n \t\t\t}\n \t\t} else {\n \t\t\t/* exact port matching /\n-\t\t\tpr_debug(\"src or dst matches with %d?\\n\", s);\n-\n \t\t\tswitch (minfo-\u003eflags) {\n \t\t\tcase XT_MULTIPORT_SOURCE:\n \t\t\t\tif (src == s)\n@@ -97,7 +94,6 @@ multiport_mt(const struct sk_buff skb, struct xt_action_param par)\n \t\t/ We've been asked to examine this packet, and we\n \t\t * can't. Hence, no choice but to drop.\n \t\t /\n-\t\tpr_debug(\"Dropping evil offset=0 tinygram.\\n\");\n \t\tpar-\u003ehotdrop = true;\n \t\treturn false;\n \t}\ndiff --git a/net/netfilter/xt_sctp.c b/net/netfilter/xt_sctp.c\nindex b46a6a5120583..d35c21d9651b0 100644\n--- a/net/netfilter/xt_sctp.c\n+++ b/net/netfilter/xt_sctp.c\n@@ -48,30 +48,17 @@ match_packet(const struct sk_buff skb,\n \tconst struct xt_sctp_flag_info flag_info = info-\u003eflag_info;\n \tint flag_count = info-\u003eflag_count;\n \n-#ifdef DEBUG\n-\tint i = 0;\n-#endif\n-\n \tif (chunk_match_type == SCTP_CHUNK_MATCH_ALL)\n \t\tSCTP_CHUNKMAP_COPY(chunkmapcopy, info-\u003echunkmap);\n \n \tdo {\n \t\tsch = skb_header_pointer(skb, offset, sizeof(_sch), \u0026_sch);\n \t\tif (sch == NULL \|\| sch-\u003elength == 0) {\n-\t\t\tpr_debug(\"Dropping invalid SCTP packet.\\n\");\n \t\t\thotdrop = true;\n \t\t\treturn false;\n \t\t}\n-#ifdef DEBUG\n-\t\tpr_debug(\"Chunk num: %d\\toffset: %d\\ttype: %d\\tlength: %d\"\n-\t\t\t \"\\tflags: %x\\n\",\n-\t\t\t ++i, offset, sch-\u003etype, htons(sch-\u003elength),\n-\t\t\t sch-\u003eflags);\n-#endif\n \t\toffset += SCTP_PAD4(ntohs(sch-\u003elength));\n \n-\t\tpr_debug(\"skb-\u003elen: %d\\toffset: %d\\n\", skb-\u003elen, offset);\n-\n \t\tif (SCTP_CHUNKMAP_IS_SET(info-\u003echunkmap, sch-\u003etype)) {\n \t\t\tswitch (chunk_match_type) {\n \t\t\tcase SCTP_CHUNK_MATCH_ANY:\n@@ -121,18 +108,14 @@ sctp_mt(const struct sk_buff skb, struct xt_action_param par)\n \tconst struct sctphdr sh;\n \tstruct sctphdr _sh;\n \n-\tif (par-\u003efragoff != 0) {\n-\t\tpr_debug(\"Dropping non-first fragment.. FIXME\\n\");\n+\tif (par-\u003efragoff != 0)\n \t\treturn false;\n-\t}\n \n \tsh = skb_header_pointer(skb, par-\u003ethoff, sizeof(_sh), \u0026_sh);\n \tif (sh == NULL) {\n-\t\tpr_debug(\"Dropping evil TCP offset=0 tinygram.\\n\");\n \t\tpar-\u003ehotdrop = true;\n \t\treturn false;\n \t}\n-\tpr_debug(\"spt: %d\\tdpt: %d\\n\", ntohs(sh-\u003esource), ntohs(sh-\u003edest));\n \n \treturn SCCHECK(ntohs(sh-\u003esource) \u003e= info-\u003espts[0]\n \t\t\t\u0026\u0026 ntohs(sh-\u003esource) \u003c= info-\u003espts[1],\ndiff --git a/net/netfilter/xt_tcpudp.c b/net/netfilter/xt_tcpudp.c\nindex f76cf18f1a244..70608b8d06ab2 100644\n--- a/net/netfilter/xt_tcpudp.c\n+++ b/net/netfilter/xt_tcpudp.c\n@@ -44,8 +44,6 @@ tcp_find_option(u_int8_t option,\n \tu_int8_t _opt[60 - sizeof(struct tcphdr)];\n \tunsigned int i;\n \n-\tpr_debug(\"finding option\\n\");\n-\n \tif (!optlen)\n \t\treturn invert;\n \n@@ -81,10 +79,8 @@ static bool tcp_mt(const struct sk_buff skb, struct xt_action_param par)\n \t\t causes this. Its a cracker trying to break in by doing a\n \t\t flag overwrite to pass the direction checks.\n \t\t/\n-\t\tif (par-\u003efragoff == 1) {\n-\t\t\tpr_debug(\"Dropping evil TCP offset=1 frag.\\n\");\n+\t\tif (par-\u003efragoff == 1)\n \t\t\tpar-\u003ehotdrop = true;\n-\t\t}\n \t\t/* Must not be a fragment. /\n \t\treturn false;\n \t}\n@@ -93,7 +89,6 @@ static bool tcp_mt(const struct sk_buff skb, struct xt_action_param par)\n \tif (th == NULL) {\n \t\t/ We've been asked to examine this packet, and we\n \t\t can't. Hence, no choice but to drop. /\n-\t\tpr_debug(\"Dropping evil TCP offset=0 tinygram.\\n\");\n \t\tpar-\u003ehotdrop = true;\n \t\treturn false;\n \t}\n@@ -145,7 +140,6 @@ static bool udp_mt(const struct sk_buff skb, struct xt_action_param par)\n \tif (uh == NULL) {\n \t\t/ We've been asked to examine this packet, and we\n \t\t can't. Hence, no choice but to drop. */\n-\t\tpr_debug(\"Dropping evil UDP tinygram.\\n\");\n \t\tpar-\u003ehotdrop = true;\n \t\treturn false;\n \t}\n" }
2/1	2026/08/18 14:39	agent	patch-evaluator	2m Model: best-expensive Args: null Results: { "EnableConfigs": [ "NETFILTER_XT_TARGET_CT", "NETFILTER_XT_TARGET_IDLETIMER", "NF_CONNTRACK", "IP_NF_RAW", "NETFILTER_ADVANCED" ], "FocusSymbols": [ "xt_ct_tg_check", "idletimer_tg_checkentry", "idletimer_tg_checkentry_v1" ], "Reasoning": "The patch modifies `xt_CT.c` to change the validation logic for `info-\u003ehelper` and `info-\u003etimeout`. If they are not null-terminated, the new code skips setting them instead of returning `-ENAMETOOLONG`, which is a functional change in the target initialization logic. The patch also modifies `xt_IDLETIMER.c` to release a mutex before logging, which is a minor functional change. These changes alter the execution flow and are reachable from userspace via netfilter configuration.", "WorthFuzzing": true } Instruction: You are an expert Linux kernel maintainer. Your job is to review a provided patch series and determine if it makes functional changes to the kernel that should be fuzzed. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively use your code access tools to examine the actual source code and confirm any assumptions. Return WorthFuzzing=false if the patch only contains: - Modifications to Documentation/, Kconfig files, or code comments. - Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints. - Changes to numeric constants or macros that do not functionally alter execution flow. - Code paths that are impossible to reach in virtualized environments like GCE or QEMU, even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim). - Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed, ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU. - Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove) that are executed only during PCI hot-unplug or sysfs driver unbind operations. If it modifies reachable core kernel logic, drivers, or architectures, use your code search tools to verify the code can be executed, then return WorthFuzzing=true. When returning WorthFuzzing=true, you MUST ALSO: 1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols. Avoid listing generic hot-path functions to prevent skewed test distributions. Prefer non-static, non-inlined API entrypoint functions over internal static helper functions (which are inlined by the compiler and do not have distinct symbol addresses). 2. Identify any specific CONFIG_ options required to properly test this new/modified feature. Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions. Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: For your convenience, here is the diff of the changes: commit 9338aec55ce1ed0fef018b0c87a6ae341b6a6a77 Author: syz-cluster <triage@syzkaller.com> Date: Tue Aug 18 14:39:20 2026 +0000 syz-cluster: applied patch under review diff --git a/net/ipv4/netfilter/ipt_ah.c b/net/ipv4/netfilter/ipt_ah.c index 161ba412cb08b..7131f297ada2e 100644 --- a/net/ipv4/netfilter/ipt_ah.c +++ b/net/ipv4/netfilter/ipt_ah.c @@ -19,12 +19,7 @@ MODULE_DESCRIPTION("Xtables: IPv4 IPsec-AH SPI match"); static inline bool spi_match(u_int32_t min, u_int32_t max, u_int32_t spi, bool invert) { - bool r; - pr_debug("spi_match:%c 0x%x <= 0x%x <= 0x%x\n", - invert ? '!' : ' ', min, spi, max); - r = (spi >= min && spi <= max) ^ invert; - pr_debug(" result %s\n", r ? "PASS" : "FAILED"); - return r; + return (spi >= min && spi <= max) ^ invert; } static bool ah_mt(const struct sk_buff skb, struct xt_action_param par) @@ -42,7 +37,6 @@ static bool ah_mt(const struct sk_buff skb, struct xt_action_param par) /* We've been asked to examine this packet, and we * can't. Hence, no choice but to drop. / - pr_debug("Dropping evil AH tinygram.\n"); par->hotdrop = true; return false; } @@ -58,7 +52,7 @@ static int ah_mt_check(const struct xt_mtchk_param par) /* Must specify no unknown invflags / if (ahinfo->invflags & ~IPT_AH_INV_MASK) { - pr_debug("unknown flags %X\n", ahinfo->invflags); + pr_info_ratelimited("unknown flags %X\n", ahinfo->invflags); return -EINVAL; } return 0; diff --git a/net/ipv4/netfilter/ipt_rpfilter.c b/net/ipv4/netfilter/ipt_rpfilter.c index 6d9bf51068684..2c38fd6624aa1 100644 --- a/net/ipv4/netfilter/ipt_rpfilter.c +++ b/net/ipv4/netfilter/ipt_rpfilter.c @@ -95,8 +95,7 @@ static int rpfilter_check(const struct xt_mtchk_param par) if (strcmp(par->table, "mangle") != 0 && strcmp(par->table, "raw") != 0) { - pr_info_ratelimited("only valid in \'raw\' or \'mangle\' table, not \'%s\'\n", - par->table); + pr_info_ratelimited("only valid in \'raw\' or \'mangle\' table\n"); return -EINVAL; } diff --git a/net/ipv6/netfilter/ip6t_ah.c b/net/ipv6/netfilter/ip6t_ah.c index 1258783ed8762..dab7dbc6a675c 100644 --- a/net/ipv6/netfilter/ip6t_ah.c +++ b/net/ipv6/netfilter/ip6t_ah.c @@ -24,13 +24,7 @@ MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>"); static inline bool spi_match(u_int32_t min, u_int32_t max, u_int32_t spi, bool invert) { - bool r; - - pr_debug("spi_match:%c 0x%x <= 0x%x <= 0x%x\n", - invert ? '!' : ' ', min, spi, max); - r = (spi >= min && spi <= max) ^ invert; - pr_debug(" result %s\n", r ? "PASS" : "FAILED"); - return r; + return (spi >= min && spi <= max) ^ invert; } static bool ah_mt6(const struct sk_buff skb, struct xt_action_param par) @@ -62,23 +56,6 @@ static bool ah_mt6(const struct sk_buff skb, struct xt_action_param par) return false; } - pr_debug("IPv6 AH LEN %u %u ", hdrlen, ah->hdrlen); - pr_debug("RES %04X ", ah->reserved); - pr_debug("SPI %u %08X\n", ntohl(ah->spi), ntohl(ah->spi)); - - pr_debug("IPv6 AH spi %02X ", - spi_match(ahinfo->spis[0], ahinfo->spis[1], - ntohl(ah->spi), - !!(ahinfo->invflags & IP6T_AH_INV_SPI))); - pr_debug("len %02X %04X %02X ", - ahinfo->hdrlen, hdrlen, - (!ahinfo->hdrlen \|\| - (ahinfo->hdrlen == hdrlen) ^ - !!(ahinfo->invflags & IP6T_AH_INV_LEN))); - pr_debug("res %02X %04X %02X\n", - ahinfo->hdrres, ah->reserved, - !(ahinfo->hdrres && ah->reserved)); - return spi_match(ahinfo->spis[0], ahinfo->spis[1], ntohl(ah->spi), !!(ahinfo->invflags & IP6T_AH_INV_SPI)) && @@ -93,7 +70,7 @@ static int ah_mt6_check(const struct xt_mtchk_param par) const struct ip6t_ah ahinfo = par->matchinfo; if (ahinfo->invflags & ~IP6T_AH_INV_MASK) { - pr_debug("unknown flags %X\n", ahinfo->invflags); + pr_info_ratelimited("unknown flags %X\n", ahinfo->invflags); return -EINVAL; } return 0; diff --git a/net/ipv6/netfilter/ip6t_frag.c b/net/ipv6/netfilter/ip6t_frag.c index 3aad6439386b1..f5f3cfb8704cf 100644 --- a/net/ipv6/netfilter/ip6t_frag.c +++ b/net/ipv6/netfilter/ip6t_frag.c @@ -23,12 +23,7 @@ MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>"); static inline bool id_match(u_int32_t min, u_int32_t max, u_int32_t id, bool invert) { - bool r; - pr_debug("id_match:%c 0x%x <= 0x%x <= 0x%x\n", invert ? '!' : ' ', - min, id, max); - r = (id >= min && id <= max) ^ invert; - pr_debug(" result %s\n", r ? "PASS" : "FAILED"); - return r; + return (id >= min && id <= max) ^ invert; } static bool @@ -53,38 +48,6 @@ frag_mt6(const struct sk_buff skb, struct xt_action_param par) return false; } - pr_debug("INFO %04X ", fh->frag_off); - pr_debug("OFFSET %04X ", ntohs(fh->frag_off) & ~0x7); - pr_debug("RES %02X %04X", fh->reserved, ntohs(fh->frag_off) & 0x6); - pr_debug("MF %04X ", fh->frag_off & htons(IP6_MF)); - pr_debug("ID %u %08X\n", ntohl(fh->identification), - ntohl(fh->identification)); - - pr_debug("IPv6 FRAG id %02X ", - id_match(fraginfo->ids[0], fraginfo->ids[1], - ntohl(fh->identification), - !!(fraginfo->invflags & IP6T_FRAG_INV_IDS))); - pr_debug("res %02X %02X%04X %02X ", - fraginfo->flags & IP6T_FRAG_RES, fh->reserved, - ntohs(fh->frag_off) & 0x6, - !((fraginfo->flags & IP6T_FRAG_RES) && - (fh->reserved \|\| (ntohs(fh->frag_off) & 0x06)))); - pr_debug("first %02X %02X %02X ", - fraginfo->flags & IP6T_FRAG_FST, - ntohs(fh->frag_off) & ~0x7, - !((fraginfo->flags & IP6T_FRAG_FST) && - (ntohs(fh->frag_off) & ~0x7))); - pr_debug("mf %02X %02X %02X ", - fraginfo->flags & IP6T_FRAG_MF, - ntohs(fh->frag_off) & IP6_MF, - !((fraginfo->flags & IP6T_FRAG_MF) && - !((ntohs(fh->frag_off) & IP6_MF)))); - pr_debug("last %02X %02X %02X\n", - fraginfo->flags & IP6T_FRAG_NMF, - ntohs(fh->frag_off) & IP6_MF, - !((fraginfo->flags & IP6T_FRAG_NMF) && - (ntohs(fh->frag_off) & IP6_MF))); - return id_match(fraginfo->ids[0], fraginfo->ids[1], ntohl(fh->identification), !!(fraginfo->invflags & IP6T_FRAG_INV_IDS)) && @@ -103,7 +66,7 @@ static int frag_mt6_check(const struct xt_mtchk_param par) const struct ip6t_frag fraginfo = par->matchinfo; if (fraginfo->invflags & ~IP6T_FRAG_INV_MASK) { - pr_debug("unknown flags %X\n", fraginfo->invflags); + pr_info_ratelimited("unknown flags %X\n", fraginfo->invflags); return -EINVAL; } return 0; diff --git a/net/ipv6/netfilter/ip6t_hbh.c b/net/ipv6/netfilter/ip6t_hbh.c index 6d1a5d2026a67..37c207d3152a4 100644 --- a/net/ipv6/netfilter/ip6t_hbh.c +++ b/net/ipv6/netfilter/ip6t_hbh.c @@ -79,14 +79,6 @@ hbh_mt6(const struct sk_buff skb, struct xt_action_param par) return false; } - pr_debug("IPv6 OPTS LEN %u %u ", hdrlen, oh->hdrlen); - - pr_debug("len %02X %04X %02X ", - optinfo->hdrlen, hdrlen, - (!(optinfo->flags & IP6T_OPTS_LEN) \|\| - ((optinfo->hdrlen == hdrlen) ^ - !!(optinfo->invflags & IP6T_OPTS_INV_LEN)))); - ret = (!(optinfo->flags & IP6T_OPTS_LEN) \|\| ((optinfo->hdrlen == hdrlen) ^ !!(optinfo->invflags & IP6T_OPTS_INV_LEN))); @@ -96,8 +88,6 @@ hbh_mt6(const struct sk_buff skb, struct xt_action_param par) if (!(optinfo->flags & IP6T_OPTS_OPTS)) { return ret; } else { - pr_debug("Strict "); - pr_debug("#%d ", optinfo->optsnr); for (temp = 0; temp < optinfo->optsnr; temp++) { /* type field exists ? / if (hdrlen < 1) @@ -108,13 +98,9 @@ hbh_mt6(const struct sk_buff skb, struct xt_action_param par) break; / Type check / - if (tp != (optinfo->opts[temp] & 0xFF00) >> 8) { - pr_debug("Tbad %02X %02X\n", tp, - (optinfo->opts[temp] & 0xFF00) >> 8); + if (tp != (optinfo->opts[temp] & 0xFF00) >> 8) return false; - } else { - pr_debug("Tok "); - } + /* Length check / if (tp) { u16 spec_len; @@ -129,26 +115,18 @@ hbh_mt6(const struct sk_buff skb, struct xt_action_param par) break; spec_len = optinfo->opts[temp] & 0x00FF; - if (spec_len != 0x00FF && spec_len != lp) { - pr_debug("Lbad %02X %04X\n", lp, - spec_len); + if (spec_len != 0x00FF && spec_len != lp) return false; - } - pr_debug("Lok "); + optlen = lp + 2; } else { - pr_debug("Pad1\n"); optlen = 1; } - /* Step to the next / - pr_debug("len%04X\n", optlen); - if ((ptr > skb->len - optlen \|\| hdrlen < optlen) && - temp < optinfo->optsnr - 1) { - pr_debug("new pointer is too large!\n"); + temp < optinfo->optsnr - 1) break; - } + ptr += optlen; hdrlen -= optlen; } @@ -166,16 +144,16 @@ static int hbh_mt6_check(const struct xt_mtchk_param par) const struct ip6t_opts optsinfo = par->matchinfo; if (optsinfo->invflags & ~IP6T_OPTS_INV_MASK) { - pr_debug("unknown flags %X\n", optsinfo->invflags); + pr_info_ratelimited("unknown flags %X\n", optsinfo->invflags); return -EINVAL; } if (optsinfo->optsnr > IP6T_OPTS_OPTSNR) { - pr_debug("too many supported opts specified\n"); + pr_info_ratelimited("too many supported opts specified\n"); return -EINVAL; } if (optsinfo->flags & IP6T_OPTS_NSTRICT) { - pr_debug("Not strict - not implemented"); + pr_info_ratelimited("Not strict - not implemented"); return -EINVAL; } diff --git a/net/ipv6/netfilter/ip6t_mh.c b/net/ipv6/netfilter/ip6t_mh.c index fd492b69acbc0..ba6dcc7791a09 100644 --- a/net/ipv6/netfilter/ip6t_mh.c +++ b/net/ipv6/netfilter/ip6t_mh.c @@ -42,14 +42,11 @@ static bool mh_mt6(const struct sk_buff skb, struct xt_action_param par) if (mh == NULL) { / We've been asked to examine this packet, and we can't. Hence, no choice but to drop. / - pr_debug("Dropping evil MH tinygram.\n"); par->hotdrop = true; return false; } if (mh->ip6mh_proto != IPPROTO_NONE) { - pr_debug("Dropping invalid MH Payload Proto: %u\n", - mh->ip6mh_proto); par->hotdrop = true; return false; } diff --git a/net/ipv6/netfilter/ip6t_rpfilter.c b/net/ipv6/netfilter/ip6t_rpfilter.c index 67c87a88cde4f..af8d10d49de81 100644 --- a/net/ipv6/netfilter/ip6t_rpfilter.c +++ b/net/ipv6/netfilter/ip6t_rpfilter.c @@ -118,7 +118,7 @@ static int rpfilter_check(const struct xt_mtchk_param par) if (strcmp(par->table, "mangle") != 0 && strcmp(par->table, "raw") != 0) { - pr_info_ratelimited("only valid in \'raw\' or \'mangle\' table, not \'%s\'\n", + pr_info_ratelimited("only valid in \'raw\' or \'mangle\' table\n", par->table); return -EINVAL; } diff --git a/net/ipv6/netfilter/ip6t_rt.c b/net/ipv6/netfilter/ip6t_rt.c index 278b52752f364..0c01ac2746d1f 100644 --- a/net/ipv6/netfilter/ip6t_rt.c +++ b/net/ipv6/netfilter/ip6t_rt.c @@ -155,18 +155,18 @@ static int rt_mt6_check(const struct xt_mtchk_param par) const struct ip6t_rt rtinfo = par->matchinfo; if (rtinfo->invflags & ~IP6T_RT_INV_MASK) { - pr_debug("unknown flags %X\n", rtinfo->invflags); + pr_info_ratelimited("unknown flags %X\n", rtinfo->invflags); return -EINVAL; } if (rtinfo->addrnr > IP6T_RT_HOPS) { - pr_debug("too many addresses specified\n"); + pr_info_ratelimited("too many addresses specified\n"); return -EINVAL; } if ((rtinfo->flags & (IP6T_RT_RES \| IP6T_RT_FST_MASK)) && (!(rtinfo->flags & IP6T_RT_TYP) \|\| (rtinfo->rt_type != 0) \|\| (rtinfo->invflags & IP6T_RT_INV_TYP))) { - pr_debug("`--rt-type 0' required before `--rt-0-'"); + pr_info_ratelimited("`--rt-type 0' required before `--rt-0-'"); return -EINVAL; } diff --git a/net/netfilter/xt_CONNSECMARK.c b/net/netfilter/xt_CONNSECMARK.c index 1494b3ee30e11..4e4436a9104b4 100644 --- a/net/netfilter/xt_CONNSECMARK.c +++ b/net/netfilter/xt_CONNSECMARK.c @@ -87,8 +87,7 @@ static int connsecmark_tg_check(const struct xt_tgchk_param par) if (strcmp(par->table, "mangle") != 0 && strcmp(par->table, "security") != 0) { - pr_info_ratelimited("only valid in \'mangle\' or \'security\' table, not \'%s\'\n", - par->table); + pr_info_ratelimited("only valid in \'mangle\' or \'security\' table\n"); return -EINVAL; } diff --git a/net/netfilter/xt_CT.c b/net/netfilter/xt_CT.c index e78660dfdf4b6..91326014ade1c 100644 --- a/net/netfilter/xt_CT.c +++ b/net/netfilter/xt_CT.c @@ -195,7 +195,8 @@ static int xt_ct_tg_check(const struct xt_tgchk_param par, goto err3; } - if (info->helper[0]) { + if (info->helper[0] && + strnlen(info->helper, sizeof(info->helper)) < sizeof(info->helper)) { if (strnlen(info->helper, sizeof(info->helper)) == sizeof(info->helper)) { ret = -ENAMETOOLONG; goto err3; @@ -206,7 +207,8 @@ static int xt_ct_tg_check(const struct xt_tgchk_param par, goto err3; } - if (info->timeout[0]) { + if (info->timeout[0] && + strnlen(info->timeout, sizeof(info->timeout)) < sizeof(info->timeout)) { if (strnlen(info->timeout, sizeof(info->timeout)) == sizeof(info->timeout)) { ret = -ENAMETOOLONG; goto err4; diff --git a/net/netfilter/xt_IDLETIMER.c b/net/netfilter/xt_IDLETIMER.c index bfcf2d44e93db..15b698ea98aa6 100644 --- a/net/netfilter/xt_IDLETIMER.c +++ b/net/netfilter/xt_IDLETIMER.c @@ -102,8 +102,6 @@ static void idletimer_tg_expired(struct timer_list t) { struct idletimer_tg timer = timer_container_of(timer, t, timer); - pr_debug("timer %s expired\n", timer->attr.attr.name); - schedule_work(&timer->work); } @@ -111,7 +109,6 @@ static void idletimer_tg_alarmproc(struct alarm alarm, ktime_t now) { struct idletimer_tg timer = alarm->data; - pr_debug("alarm %s expired\n", timer->attr.attr.name); schedule_work(&timer->work); } @@ -171,7 +168,7 @@ static int idletimer_tg_create(struct idletimer_tg_info info) ret = sysfs_create_file(idletimer_tg_kobj, &info->timer->attr.attr); if (ret < 0) { - pr_debug("couldn't add file to sysfs"); + pr_info_ratelimited("couldn't add file to sysfs"); goto out_free_attr; } @@ -220,7 +217,7 @@ static int idletimer_tg_create_v1(struct idletimer_tg_info_v1 info) ret = sysfs_create_file(idletimer_tg_kobj, &info->timer->attr.attr); if (ret < 0) { - pr_debug("couldn't add file to sysfs"); + pr_info_ratelimited("couldn't add file to sysfs"); goto out_free_attr; } @@ -228,7 +225,6 @@ static int idletimer_tg_create_v1(struct idletimer_tg_info_v1 info) kobject_uevent(idletimer_tg_kobj,KOBJ_ADD); list_add(&info->timer->entry, &idletimer_tg_list); - pr_debug("timer type value is %u", info->timer_type); info->timer->timer_type = info->timer_type; info->timer->refcnt = 1; @@ -263,9 +259,6 @@ static unsigned int idletimer_tg_target(struct sk_buff skb, { const struct idletimer_tg_info info = par->targinfo; - pr_debug("resetting timer %s, timeout period %u\n", - info->label, info->timeout); - mod_timer(&info->timer->timer, secs_to_jiffies(info->timeout) + jiffies); @@ -280,9 +273,6 @@ static unsigned int idletimer_tg_target_v1(struct sk_buff skb, { const struct idletimer_tg_info_v1 info = par->targinfo; - pr_debug("resetting timer %s, timeout period %u\n", - info->label, info->timeout); - if (info->timer->timer_type & XT_IDLETIMER_ALARM) { idletimer_start_alarm_sec(info->timer, info->timeout); } else { @@ -296,17 +286,17 @@ static unsigned int idletimer_tg_target_v1(struct sk_buff skb, static int idletimer_tg_helper(struct idletimer_tg_info info) { if (info->timeout == 0) { - pr_debug("timeout value is zero\n"); + pr_info_ratelimited("timeout value is zero\n"); return -EINVAL; } if (info->timeout >= INT_MAX / 1000) { - pr_debug("timeout value is too big\n"); + pr_info_ratelimited("timeout value is too big\n"); return -EINVAL; } if (info->label[0] == '\0' \|\| strnlen(info->label, MAX_IDLETIMER_LABEL_SIZE) == MAX_IDLETIMER_LABEL_SIZE) { - pr_debug("label is empty or not nul-terminated\n"); + pr_info_ratelimited("label is empty or not nul-terminated\n"); return -EINVAL; } return 0; @@ -318,34 +308,25 @@ static int idletimer_tg_checkentry(const struct xt_tgchk_param par) struct idletimer_tg_info info = par->targinfo; int ret; - pr_debug("checkentry targinfo%s\n", info->label); - ret = idletimer_tg_helper(info); if(ret < 0) - { - pr_debug("checkentry helper return invalid\n"); return -EINVAL; - } mutex_lock(&list_mutex); info->timer = __idletimer_tg_find_by_label(info->label); if (info->timer) { if (info->timer->timer_type & XT_IDLETIMER_ALARM) { - pr_debug("Adding/Replacing rule with same label and different timer type is not allowed\n"); mutex_unlock(&list_mutex); + pr_info_ratelimited("Adding/Replacing rule with same label and different timer type is not allowed\n"); return -EINVAL; } info->timer->refcnt++; mod_timer(&info->timer->timer, secs_to_jiffies(info->timeout) + jiffies); - - pr_debug("increased refcnt of timer %s to %u\n", - info->label, info->timer->refcnt); } else { ret = idletimer_tg_create(info); if (ret < 0) { - pr_debug("failed to create timer\n"); mutex_unlock(&list_mutex); return ret; } @@ -360,30 +341,23 @@ static int idletimer_tg_checkentry_v1(const struct xt_tgchk_param par) struct idletimer_tg_info_v1 info = par->targinfo; int ret; - pr_debug("checkentry targinfo%s\n", info->label); - if (info->send_nl_msg) return -EOPNOTSUPP; ret = idletimer_tg_helper((struct idletimer_tg_info )info); if(ret < 0) - { - pr_debug("checkentry helper return invalid\n"); return -EINVAL; - } - if (info->timer_type > XT_IDLETIMER_ALARM) { - pr_debug("invalid value for timer type\n"); + if (info->timer_type > XT_IDLETIMER_ALARM) return -EINVAL; - } mutex_lock(&list_mutex); info->timer = __idletimer_tg_find_by_label(info->label); if (info->timer) { if (info->timer->timer_type != info->timer_type) { - pr_debug("Adding/Replacing rule with same label and different timer type is not allowed\n"); mutex_unlock(&list_mutex); + pr_info_ratelimited("Adding/Replacing rule with same label and different timer type is not allowed\n"); return -EINVAL; } @@ -393,21 +367,15 @@ static int idletimer_tg_checkentry_v1(const struct xt_tgchk_param par) ktime_t tout = alarm_expires_remaining(&info->timer->alarm); struct timespec64 ktimespec = ktime_to_timespec64(tout); - if (ktimespec.tv_sec > 0) { - pr_debug("time_expiry_remaining %lld\n", - ktimespec.tv_sec); + if (ktimespec.tv_sec > 0) idletimer_start_alarm_ktime(info->timer, tout); - } } else { mod_timer(&info->timer->timer, secs_to_jiffies(info->timeout) + jiffies); } - pr_debug("increased refcnt of timer %s to %u\n", - info->label, info->timer->refcnt); } else { ret = idletimer_tg_create_v1(info); if (ret < 0) { - pr_debug("failed to create timer\n"); mutex_unlock(&list_mutex); return ret; } @@ -421,19 +389,13 @@ static void idletimer_tg_destroy(const struct xt_tgdtor_param par) { const struct idletimer_tg_info info = par->targinfo; - pr_debug("destroy targinfo %s\n", info->label); - mutex_lock(&list_mutex); if (--info->timer->refcnt > 0) { - pr_debug("decreased refcnt of timer %s to %u\n", - info->label, info->timer->refcnt); mutex_unlock(&list_mutex); return; } - pr_debug("deleting timer %s\n", info->label); - list_del(&info->timer->entry); mutex_unlock(&list_mutex); @@ -448,19 +410,13 @@ static void idletimer_tg_destroy_v1(const struct xt_tgdtor_param par) { const struct idletimer_tg_info_v1 info = par->targinfo; - pr_debug("destroy targinfo %s\n", info->label); - mutex_lock(&list_mutex); if (--info->timer->refcnt > 0) { - pr_debug("decreased refcnt of timer %s to %u\n", - info->label, info->timer->refcnt); mutex_unlock(&list_mutex); return; } - pr_debug("deleting timer %s\n", info->label); - list_del(&info->timer->entry); mutex_unlock(&list_mutex); @@ -534,7 +490,7 @@ static int __init idletimer_tg_init(void) idletimer_tg_class = class_create("xt_idletimer"); err = PTR_ERR(idletimer_tg_class); if (IS_ERR(idletimer_tg_class)) { - pr_debug("couldn't register device class\n"); + pr_info_ratelimited("couldn't register device class\n"); goto out; } @@ -542,7 +498,7 @@ static int __init idletimer_tg_init(void) MKDEV(0, 0), NULL, "timers"); err = PTR_ERR(idletimer_tg_device); if (IS_ERR(idletimer_tg_device)) { - pr_debug("couldn't register system device\n"); + pr_info_ratelimited("couldn't register system device\n"); goto out_class; } @@ -551,7 +507,7 @@ static int __init idletimer_tg_init(void) err = xt_register_targets(idletimer_tg, ARRAY_SIZE(idletimer_tg)); if (err < 0) { - pr_debug("couldn't register xt target\n"); + pr_info_ratelimited("couldn't register xt target\n"); goto out_dev; } diff --git a/net/netfilter/xt_LOG.c b/net/netfilter/xt_LOG.c index f39244f9c0ed9..de3f176792a07 100644 --- a/net/netfilter/xt_LOG.c +++ b/net/netfilter/xt_LOG.c @@ -50,12 +50,12 @@ static int log_tg_check(const struct xt_tgchk_param par) return -EINVAL; if (loginfo->level >= 8) { - pr_debug("level %u >= 8\n", loginfo->level); + pr_info_ratelimited("level %u >= 8\n", loginfo->level); return -EINVAL; } if (loginfo->prefix[sizeof(loginfo->prefix)-1] != '\0') { - pr_debug("prefix is not null-terminated\n"); + pr_info_ratelimited("prefix is not null-terminated\n"); return -EINVAL; } diff --git a/net/netfilter/xt_MASQUERADE.c b/net/netfilter/xt_MASQUERADE.c index eae05c1783367..cea488cec5445 100644 --- a/net/netfilter/xt_MASQUERADE.c +++ b/net/netfilter/xt_MASQUERADE.c @@ -21,11 +21,11 @@ static int masquerade_tg_check(const struct xt_tgchk_param par) const struct nf_nat_ipv4_multi_range_compat mr = par->targinfo; if (mr->range[0].flags & NF_NAT_RANGE_MAP_IPS) { - pr_debug("bad MAP_IPS.\n"); + pr_info_ratelimited("bad MAP_IPS.\n"); return -EINVAL; } if (mr->rangesize != 1) { - pr_debug("bad rangesize %u\n", mr->rangesize); + pr_info_ratelimited("bad rangesize %u\n", mr->rangesize); return -EINVAL; } return nf_ct_netns_get(par->net, par->family); diff --git a/net/netfilter/xt_NETMAP.c b/net/netfilter/xt_NETMAP.c index cb2ee80d84fa8..8c86d9a43373a 100644 --- a/net/netfilter/xt_NETMAP.c +++ b/net/netfilter/xt_NETMAP.c @@ -106,11 +106,11 @@ static int netmap_tg4_check(const struct xt_tgchk_param par) const struct nf_nat_ipv4_multi_range_compat mr = par->targinfo; if (!(mr->range[0].flags & NF_NAT_RANGE_MAP_IPS)) { - pr_debug("bad MAP_IPS.\n"); + pr_info_ratelimited("bad MAP_IPS.\n"); return -EINVAL; } if (mr->rangesize != 1) { - pr_debug("bad rangesize %u.\n", mr->rangesize); + pr_info_ratelimited("bad rangesize %u.\n", mr->rangesize); return -EINVAL; } return nf_ct_netns_get(par->net, par->family); diff --git a/net/netfilter/xt_REDIRECT.c b/net/netfilter/xt_REDIRECT.c index ff66b56a3f97d..27bc0545c4f74 100644 --- a/net/netfilter/xt_REDIRECT.c +++ b/net/netfilter/xt_REDIRECT.c @@ -51,11 +51,11 @@ static int redirect_tg4_check(const struct xt_tgchk_param par) const struct nf_nat_ipv4_multi_range_compat mr = par->targinfo; if (mr->range[0].flags & NF_NAT_RANGE_MAP_IPS) { - pr_debug("bad MAP_IPS.\n"); + pr_info_ratelimited("bad MAP_IPS.\n"); return -EINVAL; } if (mr->rangesize != 1) { - pr_debug("bad rangesize %u.\n", mr->rangesize); + pr_info_ratelimited("bad rangesize %u.\n", mr->rangesize); return -EINVAL; } return nf_ct_netns_get(par->net, par->family); diff --git a/net/netfilter/xt_SECMARK.c b/net/netfilter/xt_SECMARK.c index 5bc5ea505eb9e..38e8e410b4e81 100644 --- a/net/netfilter/xt_SECMARK.c +++ b/net/netfilter/xt_SECMARK.c @@ -79,8 +79,7 @@ secmark_tg_check(const char table, struct xt_secmark_target_info_v1 info) if (strcmp(table, "mangle") != 0 && strcmp(table, "security") != 0) { - pr_info_ratelimited("only valid in \'mangle\' or \'security\' table, not \'%s\'\n", - table); + pr_info_ratelimited("only valid in \'mangle\' or \'security\' table\n"); return -EINVAL; } diff --git a/net/netfilter/xt_cgroup.c b/net/netfilter/xt_cgroup.c index 43d2ae2be628d..ac1b7e71cd7f5 100644 --- a/net/netfilter/xt_cgroup.c +++ b/net/netfilter/xt_cgroup.c @@ -33,7 +33,7 @@ static int cgroup_mt_check_v0(const struct xt_mtchk_param par) return -EINVAL; if (!IS_ENABLED(CONFIG_CGROUP_NET_CLASSID)) { - pr_info(NET_CLS_CLASSID_INVALID_MSG); + pr_info_ratelimited(NET_CLS_CLASSID_INVALID_MSG); return -EINVAL; } @@ -49,7 +49,7 @@ static int cgroup_mt_check_v1(const struct xt_mtchk_param par) return -EINVAL; if (!info->has_path && !info->has_classid) { - pr_info("xt_cgroup: no path or classid specified\n"); + pr_info_ratelimited("xt_cgroup: no path or classid specified\n"); return -EINVAL; } @@ -59,7 +59,7 @@ static int cgroup_mt_check_v1(const struct xt_mtchk_param par) } if (info->has_classid && !IS_ENABLED(CONFIG_CGROUP_NET_CLASSID)) { - pr_info(NET_CLS_CLASSID_INVALID_MSG); + pr_info_ratelimited(NET_CLS_CLASSID_INVALID_MSG); return -EINVAL; } @@ -89,7 +89,7 @@ static int cgroup_mt_check_v2(const struct xt_mtchk_param par) return -EINVAL; if (!info->has_path && !info->has_classid) { - pr_info("xt_cgroup: no path or classid specified\n"); + pr_info_ratelimited("xt_cgroup: no path or classid specified\n"); return -EINVAL; } @@ -99,7 +99,7 @@ static int cgroup_mt_check_v2(const struct xt_mtchk_param par) } if (info->has_classid && !IS_ENABLED(CONFIG_CGROUP_NET_CLASSID)) { - pr_info(NET_CLS_CLASSID_INVALID_MSG); + pr_info_ratelimited(NET_CLS_CLASSID_INVALID_MSG); return -EINVAL; } diff --git a/net/netfilter/xt_esp.c b/net/netfilter/xt_esp.c index 2a1c0ad0ff079..68fd75884268a 100644 --- a/net/netfilter/xt_esp.c +++ b/net/netfilter/xt_esp.c @@ -25,12 +25,7 @@ MODULE_ALIAS("ip6t_esp"); static inline bool spi_match(u_int32_t min, u_int32_t max, u_int32_t spi, bool invert) { - bool r; - pr_debug("spi_match:%c 0x%x <= 0x%x <= 0x%x\n", - invert ? '!' : ' ', min, spi, max); - r = (spi >= min && spi <= max) ^ invert; - pr_debug(" result %s\n", r ? "PASS" : "FAILED"); - return r; + return (spi >= min && spi <= max) ^ invert; } static bool esp_mt(const struct sk_buff skb, struct xt_action_param par) @@ -48,7 +43,6 @@ static bool esp_mt(const struct sk_buff skb, struct xt_action_param par) /* We've been asked to examine this packet, and we * can't. Hence, no choice but to drop. / - pr_debug("Dropping evil ESP tinygram.\n"); par->hotdrop = true; return false; } @@ -62,7 +56,7 @@ static int esp_mt_check(const struct xt_mtchk_param par) const struct xt_esp espinfo = par->matchinfo; if (espinfo->invflags & ~XT_ESP_INV_MASK) { - pr_debug("unknown flags %X\n", espinfo->invflags); + pr_info_ratelimited("unknown flags %X\n", espinfo->invflags); return -EINVAL; } diff --git a/net/netfilter/xt_ipcomp.c b/net/netfilter/xt_ipcomp.c index 472da639a32e2..3299c1ea60f9e 100644 --- a/net/netfilter/xt_ipcomp.c +++ b/net/netfilter/xt_ipcomp.c @@ -29,12 +29,7 @@ MODULE_ALIAS("ip6t_ipcomp"); static inline bool spi_match(u_int32_t min, u_int32_t max, u_int32_t spi, bool invert) { - bool r; - pr_debug("spi_match:%c 0x%x <= 0x%x <= 0x%x\n", - invert ? '!' : ' ', min, spi, max); - r = (spi >= min && spi <= max) ^ invert; - pr_debug(" result %s\n", r ? "PASS" : "FAILED"); - return r; + return (spi >= min && spi <= max) ^ invert; } static bool comp_mt(const struct sk_buff skb, struct xt_action_param par) @@ -52,7 +47,6 @@ static bool comp_mt(const struct sk_buff skb, struct xt_action_param par) / We've been asked to examine this packet, and we * can't. Hence, no choice but to drop. / - pr_debug("Dropping evil IPComp tinygram.\n"); par->hotdrop = true; return false; } diff --git a/net/netfilter/xt_iprange.c b/net/netfilter/xt_iprange.c index 0c9e014e30b49..bf61141fb7850 100644 --- a/net/netfilter/xt_iprange.c +++ b/net/netfilter/xt_iprange.c @@ -24,27 +24,15 @@ iprange_mt4(const struct sk_buff skb, struct xt_action_param par) m = ntohl(iph->saddr) < ntohl(info->src_min.ip); m \|= ntohl(iph->saddr) > ntohl(info->src_max.ip); m ^= !!(info->flags & IPRANGE_SRC_INV); - if (m) { - pr_debug("src IP %pI4 NOT in range %s%pI4-%pI4\n", - &iph->saddr, - (info->flags & IPRANGE_SRC_INV) ? "(INV) " : "", - &info->src_min.ip, - &info->src_max.ip); + if (m) return false; - } } if (info->flags & IPRANGE_DST) { m = ntohl(iph->daddr) < ntohl(info->dst_min.ip); m \|= ntohl(iph->daddr) > ntohl(info->dst_max.ip); m ^= !!(info->flags & IPRANGE_DST_INV); - if (m) { - pr_debug("dst IP %pI4 NOT in range %s%pI4-%pI4\n", - &iph->daddr, - (info->flags & IPRANGE_DST_INV) ? "(INV) " : "", - &info->dst_min.ip, - &info->dst_max.ip); + if (m) return false; - } } return true; } @@ -73,27 +61,15 @@ iprange_mt6(const struct sk_buff skb, struct xt_action_param par) m = iprange_ipv6_lt(&iph->saddr, &info->src_min.in6); m \|= iprange_ipv6_lt(&info->src_max.in6, &iph->saddr); m ^= !!(info->flags & IPRANGE_SRC_INV); - if (m) { - pr_debug("src IP %pI6 NOT in range %s%pI6-%pI6\n", - &iph->saddr, - (info->flags & IPRANGE_SRC_INV) ? "(INV) " : "", - &info->src_min.in6, - &info->src_max.in6); + if (m) return false; - } } if (info->flags & IPRANGE_DST) { m = iprange_ipv6_lt(&iph->daddr, &info->dst_min.in6); m \|= iprange_ipv6_lt(&info->dst_max.in6, &iph->daddr); m ^= !!(info->flags & IPRANGE_DST_INV); - if (m) { - pr_debug("dst IP %pI6 NOT in range %s%pI6-%pI6\n", - &iph->daddr, - (info->flags & IPRANGE_DST_INV) ? "(INV) " : "", - &info->dst_min.in6, - &info->dst_max.in6); + if (m) return false; - } } return true; } diff --git a/net/netfilter/xt_ipvs.c b/net/netfilter/xt_ipvs.c index 253c71cc9a634..e13c0ffb73a9a 100644 --- a/net/netfilter/xt_ipvs.c +++ b/net/netfilter/xt_ipvs.c @@ -148,7 +148,6 @@ ipvs_mt(const struct sk_buff skb, struct xt_action_param par) out_put_cp: __ip_vs_conn_put(cp); out: - pr_debug("match=%d\n", match); return match; } diff --git a/net/netfilter/xt_multiport.c b/net/netfilter/xt_multiport.c index a1691ff405d3c..bff5f53a9befb 100644 --- a/net/netfilter/xt_multiport.c +++ b/net/netfilter/xt_multiport.c @@ -37,7 +37,6 @@ ports_match_v1(const struct xt_multiport_v1 minfo, if (minfo->pflags[i]) { /* range port matching / e = minfo->ports[++i]; - pr_debug("src or dst matches with %d-%d?\n", s, e); switch (minfo->flags) { case XT_MULTIPORT_SOURCE: @@ -58,8 +57,6 @@ ports_match_v1(const struct xt_multiport_v1 minfo, } } else { /* exact port matching / - pr_debug("src or dst matches with %d?\n", s); - switch (minfo->flags) { case XT_MULTIPORT_SOURCE: if (src == s) @@ -97,7 +94,6 @@ multiport_mt(const struct sk_buff skb, struct xt_action_param par) / We've been asked to examine this packet, and we * can't. Hence, no choice but to drop. / - pr_debug("Dropping evil offset=0 tinygram.\n"); par->hotdrop = true; return false; } diff --git a/net/netfilter/xt_sctp.c b/net/netfilter/xt_sctp.c index b46a6a5120583..d35c21d9651b0 100644 --- a/net/netfilter/xt_sctp.c +++ b/net/netfilter/xt_sctp.c @@ -48,30 +48,17 @@ match_packet(const struct sk_buff skb, const struct xt_sctp_flag_info flag_info = info->flag_info; int flag_count = info->flag_count; -#ifdef DEBUG - int i = 0; -#endif - if (chunk_match_type == SCTP_CHUNK_MATCH_ALL) SCTP_CHUNKMAP_COPY(chunkmapcopy, info->chunkmap); do { sch = skb_header_pointer(skb, offset, sizeof(_sch), &_sch); if (sch == NULL \|\| sch->length == 0) { - pr_debug("Dropping invalid SCTP packet.\n"); hotdrop = true; return false; } -#ifdef DEBUG - pr_debug("Chunk num: %d\toffset: %d\ttype: %d\tlength: %d" - "\tflags: %x\n", - ++i, offset, sch->type, htons(sch->length), - sch->flags); -#endif offset += SCTP_PAD4(ntohs(sch->length)); - pr_debug("skb->len: %d\toffset: %d\n", skb->len, offset); - if (SCTP_CHUNKMAP_IS_SET(info->chunkmap, sch->type)) { switch (chunk_match_type) { case SCTP_CHUNK_MATCH_ANY: @@ -121,18 +108,14 @@ sctp_mt(const struct sk_buff skb, struct xt_action_param par) const struct sctphdr sh; struct sctphdr _sh; - if (par->fragoff != 0) { - pr_debug("Dropping non-first fragment.. FIXME\n"); + if (par->fragoff != 0) return false; - } sh = skb_header_pointer(skb, par->thoff, sizeof(_sh), &_sh); if (sh == NULL) { - pr_debug("Dropping evil TCP offset=0 tinygram.\n"); par->hotdrop = true; return false; } - pr_debug("spt: %d\tdpt: %d\n", ntohs(sh->source), ntohs(sh->dest)); return SCCHECK(ntohs(sh->source) >= info->spts[0] && ntohs(sh->source) <= info->spts[1], diff --git a/net/netfilter/xt_tcpudp.c b/net/netfilter/xt_tcpudp.c index f76cf18f1a244..70608b8d06ab2 100644 --- a/net/netfilter/xt_tcpudp.c +++ b/net/netfilter/xt_tcpudp.c @@ -44,8 +44,6 @@ tcp_find_option(u_int8_t option, u_int8_t _opt[60 - sizeof(struct tcphdr)]; unsigned int i; - pr_debug("finding option\n"); - if (!optlen) return invert; @@ -81,10 +79,8 @@ static bool tcp_mt(const struct sk_buff skb, struct xt_action_param par) causes this. Its a cracker trying to break in by doing a flag overwrite to pass the direction checks. / - if (par->fragoff == 1) { - pr_debug("Dropping evil TCP offset=1 frag.\n"); + if (par->fragoff == 1) par->hotdrop = true; - } /* Must not be a fragment. / return false; } @@ -93,7 +89,6 @@ static bool tcp_mt(const struct sk_buff skb, struct xt_action_param par) if (th == NULL) { / We've been asked to examine this packet, and we can't. Hence, no choice but to drop. / - pr_debug("Dropping evil TCP offset=0 tinygram.\n"); par->hotdrop = true; return false; } @@ -145,7 +140,6 @@ static bool udp_mt(const struct sk_buff skb, struct xt_action_param par) if (uh == NULL) { / We've been asked to examine this packet, and we can't. Hence, no choice but to drop. */ - pr_debug("Dropping evil UDP tinygram.\n"); par->hotdrop = true; return false; }
3/2	2026/08/18 14:39	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 16921 output: 38 thoughts: 643 Thoughts: Analyzing the Patch: Optimization and Potential Logic Flaw Okay, let's break this down. From a quick scan, it looks like this patch touches several netfilter files – `net/ipv4/netfilter/`, `net/ipv6/netfilter/`, and `net/netfilter/`. My initial impression is that these are straightforward changes: mainly, some debugging output is being toned down by removing `pr_debug` statements, replacing debug or informational prints with rate-limited versions using `pr_info_ratelimited` in the `_check` functions. That's a reasonable optimization. Then, there’s something new in `xt_CT.c`. I see that a length check has been added for `info->helper` and `info->timeout` which is good practice. I’ve noticed a possible bug, so let me take a closer look at the code: ```c @@ -195,7 +195,8 @@ static int xt_ct_tg_check(const struct xt_tgchk_param par, goto err3; } - if (info->helper[0]) { + if (info->helper[0] && + strnlen(info->helper, sizeof(info->helper)) < sizeof(info->helper)) { if (strnlen(info->helper, sizeof(info->helper)) == sizeof(info->helper)) { ret = -ENAMETOOLONG; goto err3; @@ -206,7 +207,8 @@ static int xt_ct_tg_check(const struct xt_tgchk_param par, goto err3; } - if (info->timeout[0]) { + if (info->timeout[0] && + strnlen(info->timeout, sizeof(info->timeout)) < sizeof(info->timeout)) { if (strnlen(info->timeout, sizeof(info->timeout)) == sizeof(info->timeout)) { ret = -ENAMETOOLONG; goto err4; ``` Now, comparing the original code to the new code... I see what's happening. The original `if` condition was: ```c if (info->helper[0]) { if (strnlen(info->helper, sizeof(info->helper)) == sizeof(info->helper)) { ``` The added check is: ```c if (info->helper[0] && strnlen(info->helper, sizeof(info->helper)) < sizeof(info->helper)) { if (strnlen(info->helper, sizeof(info->helper)) == sizeof(info->helper)) { ``` The logic here looks flawed. If the condition `strnlen(info->helper, sizeof(info->helper)) < sizeof(info->helper)` is true, then the inner condition `strnlen(...) == sizeof(...)` will never be true. The code added a redundancy check for length that makes the second condition impossible, and the whole code block could be skipped. It's a subtle but significant issue; that conditional check is doing nothing. I'll need to double check the rest of the patch in `net/netfilter/xt_CT.c` to see if that happens elsewhere.
4/2	2026/08/18 14:39	tool	read-file	0m Args: { "File": "net/netfilter/xt_CT.c", "FirstLine": 180, "LineCount": 50 } Results: { "Contents": " 180:\t\tzone.id = info-\u003ezone;\n 181:\t\tzone.dir = xt_ct_flags_to_dir(info);\n 182:\t\tif (info-\u003eflags \u0026 XT_CT_ZONE_MARK)\n 183:\t\t\tzone.flags \|= NF_CT_FLAG_MARK;\n 184:\t\n 185:\t\tct = nf_ct_tmpl_alloc(par-\u003enet, \u0026zone, GFP_KERNEL);\n 186:\t\tif (!ct) {\n 187:\t\t\tret = -ENOMEM;\n 188:\t\t\tgoto err2;\n 189:\t\t}\n 190:\t\n 191:\t\tif ((info-\u003ect_events \|\| info-\u003eexp_events) \u0026\u0026\n 192:\t\t !nf_ct_ecache_ext_add(ct, info-\u003ect_events, info-\u003eexp_events,\n 193:\t\t\t\t\t GFP_KERNEL)) {\n 194:\t\t\tret = -EINVAL;\n 195:\t\t\tgoto err3;\n 196:\t\t}\n 197:\t\n 198:\t\tif (info-\u003ehelper[0] \u0026\u0026\n 199:\t\t strnlen(info-\u003ehelper, sizeof(info-\u003ehelper)) \u003c sizeof(info-\u003ehelper)) {\n 200:\t\t\tif (strnlen(info-\u003ehelper, sizeof(info-\u003ehelper)) == sizeof(info-\u003ehelper)) {\n 201:\t\t\t\tret = -ENAMETOOLONG;\n 202:\t\t\t\tgoto err3;\n 203:\t\t\t}\n 204:\t\n 205:\t\t\tret = xt_ct_set_helper(ct, info-\u003ehelper, par);\n 206:\t\t\tif (ret \u003c 0)\n 207:\t\t\t\tgoto err3;\n 208:\t\t}\n 209:\t\n 210:\t\tif (info-\u003etimeout[0] \u0026\u0026\n 211:\t\t strnlen(info-\u003etimeout, sizeof(info-\u003etimeout)) \u003c sizeof(info-\u003etimeout)) {\n 212:\t\t\tif (strnlen(info-\u003etimeout, sizeof(info-\u003etimeout)) == sizeof(info-\u003etimeout)) {\n 213:\t\t\t\tret = -ENAMETOOLONG;\n 214:\t\t\t\tgoto err4;\n 215:\t\t\t}\n 216:\t\n 217:\t\t\tret = xt_ct_set_timeout(ct, par, info-\u003etimeout);\n 218:\t\t\tif (ret \u003c 0)\n 219:\t\t\t\tgoto err4;\n 220:\t\t}\n 221:\t\t__set_bit(IPS_CONFIRMED_BIT, \u0026ct-\u003estatus);\n 222:\tout:\n 223:\t\tinfo-\u003ect = ct;\n 224:\t\treturn 0;\n 225:\t\n 226:\terr4:\n 227:\t\thelp = nfct_help(ct);\n 228:\t\txt_ct_put_helper(help);\n 229:\terr3:\n" }
5/2	2026/08/18 14:39	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 19123 output: 37 thoughts: 926 Thoughts: Analyzing the Patch: A Behavioral Shift in xt_CT.c Okay, so this patch introduces a subtle but potentially significant change in the `xt_CT.c` module, specifically within the `xt_ct_tg_check` function. The addition of `&& strnlen(info->helper, sizeof(info->helper)) < sizeof(info->helper)` to the `if` condition immediately caught my eye. My initial thought was that if `strnlen` returns the maximum buffer size (meaning `info->helper` isn't null-terminated), the entire block is now skipped. This is a crucial detail. The consequence is that instead of returning `-ENAMETOOLONG` and exiting via `err3`, the code now silently ignores the helper string. Effectively, this alters the target's behavior when encountering a helper string that exceeds the expected length or is not properly null-terminated. It bypasses the error check. I went back and double-checked the original code. Without the new condition, the original code did catch this non-null-terminated helper with the `strnlen` check and return the appropriate error code. Thus, the patch has definitely changed the function's behavior. The patch makes an implicit functional change and should be considered a bug. I quickly looked at the change in `net/netfilter/xt_IDLETIMER.c` and saw the placement of a `mutex_unlock` being changed, but it seems benign. This behavioral change is worth investigating further, and it's definitely something I want to fuzz. The original code provided error checking and the patch removed it. This is a classic example of an area that can be a source of vulnerabilities. I'll need to craft some specific test cases to explore this further.
6/2	2026/08/18 14:39	tool	grepper	0m Args: { "Expression": "xt_ct_tg_check", "PathPrefix": "net/netfilter/xt_CT.c" } Results: { "Output": "net/netfilter/xt_CT.c=140=static void xt_ct_put_helper(struct nf_conn_help help)\n--\nnet/netfilter/xt_CT.c-154-\nnet/netfilter/xt_CT.c:155:static int xt_ct_tg_check(const struct xt_tgchk_param par,\nnet/netfilter/xt_CT.c-156-\t\t\t struct xt_ct_target_info_v1 info)\n--\nnet/netfilter/xt_CT.c-236-\nnet/netfilter/xt_CT.c:237:static int xt_ct_tg_check_v0(const struct xt_tgchk_param par)\nnet/netfilter/xt_CT.c-238-{\n--\nnet/netfilter/xt_CT.c-252-\nnet/netfilter/xt_CT.c:253:\tret = xt_ct_tg_check(par, \u0026info_v1);\nnet/netfilter/xt_CT.c-254-\tif (ret \u003c 0)\n--\nnet/netfilter/xt_CT.c-261-\nnet/netfilter/xt_CT.c:262:static int xt_ct_tg_check_v1(const struct xt_tgchk_param par)\nnet/netfilter/xt_CT.c-263-{\n--\nnet/netfilter/xt_CT.c-268-\nnet/netfilter/xt_CT.c:269:\treturn xt_ct_tg_check(par, par-\u003etarginfo);\nnet/netfilter/xt_CT.c-270-}\nnet/netfilter/xt_CT.c-271-\nnet/netfilter/xt_CT.c:272:static int xt_ct_tg_check_v2(const struct xt_tgchk_param par)\nnet/netfilter/xt_CT.c-273-{\n--\nnet/netfilter/xt_CT.c-278-\nnet/netfilter/xt_CT.c:279:\treturn xt_ct_tg_check(par, par-\u003etarginfo);\nnet/netfilter/xt_CT.c-280-}\n--\nnet/netfilter/xt_CT.c=331=static struct xt_target xt_ct_tg_reg[] __read_mostly = {\n--\nnet/netfilter/xt_CT.c-344-\t\t.usersize\t= offsetof(struct xt_ct_target_info, ct),\nnet/netfilter/xt_CT.c:345:\t\t.checkentry\t= xt_ct_tg_check_v0,\nnet/netfilter/xt_CT.c-346-\t\t.destroy\t= xt_ct_tg_destroy_v0,\n--\nnet/netfilter/xt_CT.c-356-\t\t.usersize\t= offsetof(struct xt_ct_target_info_v1, ct),\nnet/netfilter/xt_CT.c:357:\t\t.checkentry\t= xt_ct_tg_check_v1,\nnet/netfilter/xt_CT.c-358-\t\t.destroy\t= xt_ct_tg_destroy_v1,\n--\nnet/netfilter/xt_CT.c-368-\t\t.usersize\t= offsetof(struct xt_ct_target_info_v1, ct),\nnet/netfilter/xt_CT.c:369:\t\t.checkentry\t= xt_ct_tg_check_v2,\nnet/netfilter/xt_CT.c-370-\t\t.destroy\t= xt_ct_tg_destroy_v1,\n--\nnet/netfilter/xt_CT.c-388-\t\t.usersize\t= offsetof(struct xt_ct_target_info, ct),\nnet/netfilter/xt_CT.c:389:\t\t.checkentry\t= xt_ct_tg_check_v0,\nnet/netfilter/xt_CT.c-390-\t\t.destroy\t= xt_ct_tg_destroy_v0,\n--\nnet/netfilter/xt_CT.c-400-\t\t.usersize\t= offsetof(struct xt_ct_target_info_v1, ct),\nnet/netfilter/xt_CT.c:401:\t\t.checkentry\t= xt_ct_tg_check_v1,\nnet/netfilter/xt_CT.c-402-\t\t.destroy\t= xt_ct_tg_destroy_v1,\n--\nnet/netfilter/xt_CT.c-412-\t\t.usersize\t= offsetof(struct xt_ct_target_info_v1, ct),\nnet/netfilter/xt_CT.c:413:\t\t.checkentry\t= xt_ct_tg_check_v2,\nnet/netfilter/xt_CT.c-414-\t\t.destroy\t= xt_ct_tg_destroy_v1,\n" }
7/2	2026/08/18 14:39	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 21699 output: 36 thoughts: 5582 Thoughts: Analysis of a Netfilter Patch: Functional Change in `xt_CT.c` Alright, let's break this down. It seems we have a patch that's primarily about cleanup - removing a bunch of `pr_debug` calls and consolidating them, presumably for a less noisy kernel log. That's fine, cosmetic mostly, won't focus on that. The significant change is in `xt_CT.c`. My expert eye is immediately drawn to this modification: ```c - if (info->helper[0]) { + if (info->helper[0] && + strnlen(info->helper, sizeof(info->helper)) < sizeof(info->helper)) { if (strnlen(info->helper, sizeof(info->helper)) == sizeof(info->helper)) { ret = -ENAMETOOLONG; goto err3; } ret = xt_ct_set_helper(ct, info->helper, par); if (ret < 0) goto err3; } ``` This is where things get interesting. The original code checked if `info->helper` existed. If it did, and if the string was not null terminated, the old code returned `-ENAMETOOLONG`. The new code adds a second check, if the length of the string is less than the buffer. Now, if the string isn't null-terminated, `strnlen` will return the size of the buffer. So, the new condition, `strnlen(...) < sizeof(...)`, is false, and the code simply skips the helper configuration. Now, previously it would have returned an error, specifically `-ENAMETOOLONG`. This is a significant functional change. It means, that instead of returning the error, the helper is silently ignored. This looks like a potential bug fix gone wrong, or a misunderstanding of the original logic. Perhaps the author was trying to prevent a potential buffer overflow but created dead code, and changed behaviour in the process. Let me think… the code is supposed to be receiving information from userspace. If I provide a non-null-terminated `helper` name, the original code would have flagged it as an error. Now, it just silently doesn't set the helper. No error is raised, the helper simply doesn't get configured. Is that what we want? This is definitely a change that impacts program flow, especially if a user expects that error message. I can't see any immediate security vulnerability or memory corruption here, but this is a behavioral change, and a silent one. I need to note this has functional implications that are testable. So, yes, it's definitely worth fuzzing. The fuzzer might not trigger a crash or corruption, but it will discover that this logic path is different. WorthFuzzing=true
8/2	2026/08/18 14:40	tool	grepper	0m Args: { "Expression": "config NETFILTER_XT_TARGET_CT", "PathPrefix": "net/netfilter/Kconfig" } Results: { "Output": "net/netfilter/Kconfig=849=config NETFILTER_XT_TARGET_CONNSECMARK\n--\nnet/netfilter/Kconfig-860-\nnet/netfilter/Kconfig:861:config NETFILTER_XT_TARGET_CT\nnet/netfilter/Kconfig-862-\ttristate '\"CT\" target support'\n" }
9/2	2026/08/18 14:40	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 28050 output: 35 thoughts: 17 Thoughts: Here's my attempt at summarizing the thought process, tailored for an expert audience: Dependency Deep Dive: NETFILTER_XT_TARGET_CT Okay, so `NETFILTER_XT_TARGET_CT`. I need to figure out the dependencies for this thing before I go any further. I'm going to start by pulling up the relevant kernel configuration options. Let's see... I'll check the usual suspects - the Kconfig files, the Makefiles, and any relevant documentation. My experience tells me there will likely be several layers of dependencies to unravel. First, are there any direct dependencies listed in the Kconfig file itself? Sometimes it's straightforward, but more often it's a web of connections. I'll need to look for things like `depends on`, `select`, or even implicit dependencies based on shared options. Next, I'll need to trace things through the build system. Are there any Makefiles that get included, or perhaps other targets that `NETFILTER_XT_TARGET_CT` relies on? I'll be looking for things like header file inclusions, object file dependencies, and any build flags that might influence the final outcome. I'll need to pay close attention to the modules involved and any other modules that might be relevant to the implementation of `CT`. Finally, I'll review any kernel documentation or mailing list discussions. It's possible there are non-obvious relationships or requirements that aren't immediately apparent from the code. I'll be looking for any caveats or gotchas that could bite me later. My goal here is a complete and accurate understanding of everything that has to be in place for this option to work, not just the basics. With all of this done, I will have the needed understanding of the scope and implications of this configuration option, so I'll be able to proceed with the next task with confidence.
10/2	2026/08/18 14:40	tool	read-file	0m Args: { "File": "net/netfilter/Kconfig", "FirstLine": 860, "LineCount": 20 } Results: { "Contents": " 860:\t\n 861:\tconfig NETFILTER_XT_TARGET_CT\n 862:\t\ttristate '\"CT\" target support'\n 863:\t\tdepends on NF_CONNTRACK\n 864:\t\tdepends on IP_NF_RAW \|\| IP6_NF_RAW \|\| NFT_COMPAT\n 865:\t\tdepends on NETFILTER_ADVANCED\n 866:\t\thelp\n 867:\t\t This options adds a `CT' target, which allows to specify initial\n 868:\t\t connection tracking parameters like events to be delivered and\n 869:\t\t the helper to be used.\n 870:\t\n 871:\t\t To compile it as a module, choose M here. If unsure, say N.\n 872:\t\n 873:\tconfig NETFILTER_XT_TARGET_DSCP\n 874:\t\ttristate '\"DSCP\" and \"TOS\" target support'\n 875:\t\tdepends on IP_NF_MANGLE \|\| IP6_NF_MANGLE \|\| NFT_COMPAT\n 876:\t\tdepends on NETFILTER_ADVANCED\n 877:\t\thelp\n 878:\t\t This option adds a `DSCP' target, which allows you to manipulate\n 879:\t\t the IPv4/IPv6 header DSCP field (differentiated services codepoint).\n" }
11/2	2026/08/18 14:40	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 28843 output: 38 thoughts: 74 Thoughts: Okay, here's my take on those config requirements, broken down from a networking kernel perspective: Kernel Configuration Dependencies for this Patch Alright, let me quickly summarize what I'm seeing here. Based on this patch, the kernel configuration needs to include a few key components. I need to ensure that `NETFILTER_XT_TARGET_CT` is enabled; clearly, connection tracking is a central piece. I'll need `NF_CONNTRACK` as the core connection tracking infrastructure is essential. We have both IPv4 and IPv6 considerations, so `IP_NF_RAW` or `IP6_NF_RAW`, or perhaps `NFT_COMPAT` are important for integrating with the raw table, and let's not forget `NETFILTER_ADVANCED` as a prerequisite for more advanced netfilter features. Hmm, wait a moment though, this patch also touches `xt_IDLETIMER.c`. I need to ensure that the idle timer functionality is properly configured too, so let me quickly cross-check its configuration and dependencies before proceeding. I'll need to double check any implications that may arise.
12/2	2026/08/18 14:40	tool	grepper	0m Args: { "Expression": "config NETFILTER_XT_TARGET_IDLETIMER", "PathPrefix": "net/netfilter/Kconfig" } Results: { "Output": "net/netfilter/Kconfig=904=config NETFILTER_XT_TARGET_HMARK\n--\nnet/netfilter/Kconfig-917-\nnet/netfilter/Kconfig:918:config NETFILTER_XT_TARGET_IDLETIMER\nnet/netfilter/Kconfig-919-\ttristate \"IDLETIMER target support\"\n" }
13/2	2026/08/18 14:40	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 29289 output: 35 thoughts: 19 Thoughts: Here's my thought process, as if I were considering this myself: Investigating the Dependencies of `NETFILTER_XT_TARGET_IDLETIMER` Okay, so I need to figure out what `NETFILTER_XT_TARGET_IDLETIMER` relies on. Understanding its dependencies is crucial. I need to make sure I don't break anything when I enable, disable, or modify this target. It's the kernel, so I have to be careful. Let's start by looking at the relevant makefiles and configuration options. I'll need to trace through the build system to see what other features or modules are linked with or required by this `IDLETIMER` target. Are there any other kernel features that rely on the idle timer logic, for example? I'll probably start with the immediate surrounding code and then back out from there, or use `make menuconfig` or `defconfig` to check. I'll need to consider how this interacts with the rest of the netfilter infrastructure – `xtables`, `iptables`, and any other target modules that might be used alongside it. The goal is a comprehensive understanding of its place within the broader system, and any conflicts or prerequisites it might introduce.
14/2	2026/08/18 14:40	tool	read-file	0m Args: { "File": "net/netfilter/Kconfig", "FirstLine": 917, "LineCount": 10 } Results: { "Contents": " 917:\t\n 918:\tconfig NETFILTER_XT_TARGET_IDLETIMER\n 919:\t\ttristate \"IDLETIMER target support\"\n 920:\t\tdepends on NETFILTER_ADVANCED\n 921:\t\thelp\n 922:\t\n 923:\t\t This option adds the `IDLETIMER' target. Each matching packet\n 924:\t\t resets the timer associated with label specified when the rule is\n 925:\t\t added. When the timer expires, it triggers a sysfs notification.\n 926:\t\t The remaining time for expiration can be read via sysfs.\n" }
15/2	2026/08/18 14:40	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 29772 output: 36 thoughts: 2912 Thoughts: Analysis of Patch Changes - A Focused Review Okay, so I've just gone through this diff. My initial focus was on potential vulnerabilities or functional regressions introduced, particularly in the netfilter code. Here's my breakdown: * `xt_IDLETIMER.c` Change: Honestly, the `xt_IDLETIMER.c` change is minor. Moving `mutex_unlock` before the `pr_info_ratelimited` call is a valid optimization—releasing the lock earlier—and while it modifies behaviour, it is unlikely to introduce significant new behaviour. * `xt_CT.c` - The Real Problem: The `xt_CT.c` change immediately caught my attention. It modifies the validation of the `info->helper` and `info->timeout` parameters used by the connection tracking target. It looks like the author tried to address a potential `strnlen` out-of-bounds read, but in doing so, they've introduced a definite bug. The logic now skips validation when the `info->helper` buffer is not null-terminated. Previously, a non-null-terminated buffer resulted in an error, so the changes lead to an undefined state where there could be out-of-bounds reads or other potential issues. This is a clear case for fuzzing. The key function to target is `xt_ct_tg_check`. * Other Changes: Mostly Logging: The remaining changes—in `xt_cgroup.c`, `xt_LOG.c`, `xt_MASQUERADE.c`, `xt_NETMAP.c`, `xt_REDIRECT.c`, `xt_SECMARK.c`, `xt_CONNSECMARK.c`, `ipt_rpfilter.c`, and `ip6t_rpfilter.c`—are predominantly about changing `pr_debug` calls to `pr_info_ratelimited` or simplifying error messages. These are generally okay, or even improvements for message flood reduction, but they don't introduce any functional regressions that I can immediately see. * Actionable Next Steps: The critical thing to do now is to focus on the `xt_CT.c` change. This needs thorough fuzzing. The focus should be on crafting inputs where `info->helper` is not null-terminated. We need to explore the exact consequences of this change in the kernel’s connection tracking logic. This is where I'd start digging with a targeted fuzzing campaign. The configs I need to pay attention to are `NETFILTER_XT_TARGET_CT`, `NF_CONNTRACK`, and either `IP_NF_RAW` or `IP6_NF_RAW`, along with `NETFILTER_ADVANCED`.
16/2	2026/08/18 14:41	tool	grepper	0m Args: { "Expression": "config IP_NF_RAW", "PathPrefix": "net/ipv4/netfilter/Kconfig" } Results: { "Output": "net/ipv4/netfilter/Kconfig=291=config IP_NF_TARGET_TTL\n--\nnet/ipv4/netfilter/Kconfig-300-# raw + specific targets\nnet/ipv4/netfilter/Kconfig:301:config IP_NF_RAW\nnet/ipv4/netfilter/Kconfig-302-\ttristate 'raw table support (required for NOTRACK/TRACE)'\n" }
17/2	2026/08/18 14:41	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 33428 output: 37 thoughts: 16 Thoughts: Here's my summary, as though I'm thinking it: Digging into IPv6 Raw Socket Filtering Okay, so I need to get a handle on how this `IP6_NF_RAW` thing works. My immediate thought is to jump into `Kconfig`. That's usually the best place to start when I need to understand a kernel feature's configuration. I need to see exactly where `IP6_NF_RAW` is defined, which dependencies it has, and perhaps even what context surrounds it. This will help me understand its purpose and where it fits into the broader picture of IPv6 raw socket filtering within the netfilter framework. Let's see what the configuration system tells me!
18/2	2026/08/18 14:41	tool	grepper	0m Args: { "Expression": "config IP6_NF_RAW", "PathPrefix": "net/ipv6/netfilter/Kconfig" } Results: { "Output": "net/ipv6/netfilter/Kconfig=234=config IP6_NF_MANGLE\n--\nnet/ipv6/netfilter/Kconfig-244-\nnet/ipv6/netfilter/Kconfig:245:config IP6_NF_RAW\nnet/ipv6/netfilter/Kconfig-246-\ttristate 'raw table support (required for TRACE)'\n" }
19/2	2026/08/18 14:41	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 33739 output: 217 thoughts: 1076 Thoughts: Reasoning Through the Netfilter Configuration and Symbol Requirements Okay, let's break this down systematically. The initial goal is to identify the required kernel configurations and relevant symbols for a specific netfilter target, likely related to connection tracking. The prompt specifies the output format for configurations, so I need to avoid the `CONFIG_` prefix. First, I identified the initial set of potentially needed configurations: `NETFILTER_XT_TARGET_CT`, `NF_CONNTRACK`, `IP_NF_RAW`, and `NETFILTER_ADVANCED`. The prompt's requirement is clear: just the bare names. Now, let's dig deeper to see if any other configurations are related to `xt_CT`. Upon examination, I see the `xt_IDLETIMER.c` file is also touched in the patch, so `NETFILTER_XT_TARGET_IDLETIMER` should also be included because it's a functional change. Next, the prompt wants symbols. The functions that seem central to the target's operation are `xt_ct_tg_check` and `idletimer_tg_checkentry`. However, the prompt emphasizes the preference for non-static, non-inlined API entry points. That gives me pause. Upon closer inspection, I confirm that both `xt_ct_tg_check` is actually static. However, it's called by `xt_ct_tg_check_v0`, `xt_ct_tg_check_v1`, `xt_ct_tg_check_v2`. These static functions are registered in `xt_ct_tg_reg` array, which is passed to `xt_register_targets`. The entry point from userspace is `xt_check_target`, but `xt_ct_tg_check` is the specific function. Since the function is not inlined, I'll provide `xt_ct_tg_check` for now and see if the fuzzer can resolve the static functions. The patch's functional changes involve changes to the validation logic for `info->helper` and `info->timeout` and modifying `xt_IDLETIMER.c` to release a mutex, which impacts the execution flow. These modifications are reachable via netfilter configuration, making them relevant to the overall target behavior. Therefore, my final list is: Configs: `NETFILTER_XT_TARGET_CT` `NETFILTER_XT_TARGET_IDLETIMER` `NF_CONNTRACK` `IP_NF_RAW` `NETFILTER_ADVANCED` Symbols: `xt_ct_tg_check` Let's proceed with these results.
20/2	2026/08/18 14:41	tool	set-results	0m Args: { "EnableConfigs": [ "NETFILTER_XT_TARGET_CT", "NETFILTER_XT_TARGET_IDLETIMER", "NF_CONNTRACK", "IP_NF_RAW", "NETFILTER_ADVANCED" ], "FocusSymbols": [ "xt_ct_tg_check", "idletimer_tg_checkentry", "idletimer_tg_checkentry_v1" ], "Reasoning": "The patch modifies `xt_CT.c` to change the validation logic for `info-\u003ehelper` and `info-\u003etimeout`. If they are not null-terminated, the new code skips setting them instead of returning `-ENAMETOOLONG`, which is a functional change in the target initialization logic. The patch also modifies `xt_IDLETIMER.c` to release a mutex before logging, which is a minor functional change. These changes alter the execution flow and are reachable from userspace via netfilter configuration.", "WorthFuzzing": true } Results: { "EnableConfigs": [ "NETFILTER_XT_TARGET_CT", "NETFILTER_XT_TARGET_IDLETIMER", "NF_CONNTRACK", "IP_NF_RAW", "NETFILTER_ADVANCED" ], "FocusSymbols": [ "xt_ct_tg_check", "idletimer_tg_checkentry", "idletimer_tg_checkentry_v1" ], "Reasoning": "The patch modifies `xt_CT.c` to change the validation logic for `info-\u003ehelper` and `info-\u003etimeout`. If they are not null-terminated, the new code skips setting them instead of returning `-ENAMETOOLONG`, which is a functional change in the target initialization logic. The patch also modifies `xt_IDLETIMER.c` to release a mutex before logging, which is a minor functional change. These changes alter the execution flow and are reachable from userspace via netfilter configuration.", "WorthFuzzing": true }
21/1	2026/08/18 14:41	action	If	0m Args: { "WorthFuzzing": true } Results: null
22/2	2026/08/18 14:41	agent	kmsan-evaluator	0m Model: best-expensive Args: null Results: { "KMSANReasoning": "The patch series primarily removes `pr_debug` statements and converts some to `pr_info_ratelimited` across various netfilter modules. There is also a logical change in `xt_CT.c` regarding the validation of `info-\u003ehelper` and `info-\u003etimeout` strings, which introduces dead code and alters the error handling for non-null-terminated strings. However, the `info` structure (`par-\u003etarginfo`) is populated via `copy_from_user` with data provided by userspace, meaning the memory is fully initialized from the kernel's perspective. The patch does not introduce any new allocations, does not expose kernel memory to userspace, and does not add control flow dependent on uninitialized kernel memory. Any bugs introduced by this patch (such as the logic flaw in `xt_CT.c`) are functional and do not involve uninitialized memory. Therefore, a dedicated KMSAN fuzzing session is not necessary.", "NeedsKMSAN": false } Instruction: You are an expert Linux kernel security engineer specializing in kernel memory error detectors (KASAN and KMSAN). Your job is to review the provided patch series and determine if the code changes justify spawning a dedicated KMSAN (KernelMemorySanitizer) fuzzing session in addition to standard KASAN fuzzing. CRITICAL DISTINCTION BETWEEN KASAN AND KMSAN: - Standard KASAN kernel builds (upstream-apparmor-kasan.config) already enable a comprehensive suite of debugging tools and sanitizers, including KASAN (out-of-bounds accesses, use-after-free, double free, invalid free), LOCKDEP (locking bugs and deadlocks), UB-sanitizers, and memory corruption checks. - KMSAN (KernelMemorySanitizer) detects reads of UNINITIALIZED memory (stack, heap, or page allocations) and kernel-to-user memory info-leaks. Rule: THERE IS NO SENSE IN RUNNING A KMSAN SESSION IF A BUG CAN BE CAUGHT BY KASAN, LOCKDEP, OR OTHER STANDARD BUG DETECTORS. A dedicated KMSAN fuzzing session incurs significant resource costs. You must ONLY set NeedsKMSAN=true if the code changes introduce or expose UNINITIALIZED MEMORY risks that are detected ONLY by KMSAN. Look holistically at the patch series and surrounding code. Even if no direct uninitialized field accesses or new buffer allocations are added in the diff itself, a patch may alter control flow, bounds checking, or data length calculations in ways that change how the rest of the code operates on existing buffers (e.g. allowing uninitialized stack/heap memory to be read, copied to user space, or used in control flow). Do not hesitate to use your code access tools to inspect the surrounding code, called functions, and callers. Set NeedsKMSAN=true ONLY IF the patch introduces or modifies: 1. Kernel structures sent to user space (via copy_to_user, put_user, netlink skb attributes, ioctl output arguments, socket options, or BPF buffers) where fields or structure padding might not be fully initialized/zeroed. 2. Conditional logic or branching that depends on potentially uninitialized variables or struct fields. 3. Allocation or initialization of complex data structures where uninitialized fields could be read later in reachable code paths. 4. Bounds checks, lengths, or logic in a way that allows surrounding code to access uninitialized bytes of existing buffers. Set NeedsKMSAN=false IF: - The code changes primarily risk out-of-bounds access, array overflows, NULL pointer dereferences, locking deadlocks, or use-after-free bugs (these are already caught by KASAN, LOCKDEP, or standard bug detectors). - All stack/heap structures touched or introduced by the patch are fully zeroed or initialized (e.g. using = {0}, memset, kzalloc) before being read or copied. - The patch does not introduce any risk of uninitialized memory usage or info-leaks. Use your code access tools to inspect the surrounding code if necessary, then provide detailed KMSANReasoning contrasting KASAN vs KMSAN applicability for this patch. Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: For your convenience, here is the diff of the changes: commit 9338aec55ce1ed0fef018b0c87a6ae341b6a6a77 Author: syz-cluster <triage@syzkaller.com> Date: Tue Aug 18 14:39:20 2026 +0000 syz-cluster: applied patch under review diff --git a/net/ipv4/netfilter/ipt_ah.c b/net/ipv4/netfilter/ipt_ah.c index 161ba412cb08b..7131f297ada2e 100644 --- a/net/ipv4/netfilter/ipt_ah.c +++ b/net/ipv4/netfilter/ipt_ah.c @@ -19,12 +19,7 @@ MODULE_DESCRIPTION("Xtables: IPv4 IPsec-AH SPI match"); static inline bool spi_match(u_int32_t min, u_int32_t max, u_int32_t spi, bool invert) { - bool r; - pr_debug("spi_match:%c 0x%x <= 0x%x <= 0x%x\n", - invert ? '!' : ' ', min, spi, max); - r = (spi >= min && spi <= max) ^ invert; - pr_debug(" result %s\n", r ? "PASS" : "FAILED"); - return r; + return (spi >= min && spi <= max) ^ invert; } static bool ah_mt(const struct sk_buff skb, struct xt_action_param par) @@ -42,7 +37,6 @@ static bool ah_mt(const struct sk_buff skb, struct xt_action_param par) /* We've been asked to examine this packet, and we * can't. Hence, no choice but to drop. / - pr_debug("Dropping evil AH tinygram.\n"); par->hotdrop = true; return false; } @@ -58,7 +52,7 @@ static int ah_mt_check(const struct xt_mtchk_param par) /* Must specify no unknown invflags / if (ahinfo->invflags & ~IPT_AH_INV_MASK) { - pr_debug("unknown flags %X\n", ahinfo->invflags); + pr_info_ratelimited("unknown flags %X\n", ahinfo->invflags); return -EINVAL; } return 0; diff --git a/net/ipv4/netfilter/ipt_rpfilter.c b/net/ipv4/netfilter/ipt_rpfilter.c index 6d9bf51068684..2c38fd6624aa1 100644 --- a/net/ipv4/netfilter/ipt_rpfilter.c +++ b/net/ipv4/netfilter/ipt_rpfilter.c @@ -95,8 +95,7 @@ static int rpfilter_check(const struct xt_mtchk_param par) if (strcmp(par->table, "mangle") != 0 && strcmp(par->table, "raw") != 0) { - pr_info_ratelimited("only valid in \'raw\' or \'mangle\' table, not \'%s\'\n", - par->table); + pr_info_ratelimited("only valid in \'raw\' or \'mangle\' table\n"); return -EINVAL; } diff --git a/net/ipv6/netfilter/ip6t_ah.c b/net/ipv6/netfilter/ip6t_ah.c index 1258783ed8762..dab7dbc6a675c 100644 --- a/net/ipv6/netfilter/ip6t_ah.c +++ b/net/ipv6/netfilter/ip6t_ah.c @@ -24,13 +24,7 @@ MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>"); static inline bool spi_match(u_int32_t min, u_int32_t max, u_int32_t spi, bool invert) { - bool r; - - pr_debug("spi_match:%c 0x%x <= 0x%x <= 0x%x\n", - invert ? '!' : ' ', min, spi, max); - r = (spi >= min && spi <= max) ^ invert; - pr_debug(" result %s\n", r ? "PASS" : "FAILED"); - return r; + return (spi >= min && spi <= max) ^ invert; } static bool ah_mt6(const struct sk_buff skb, struct xt_action_param par) @@ -62,23 +56,6 @@ static bool ah_mt6(const struct sk_buff skb, struct xt_action_param par) return false; } - pr_debug("IPv6 AH LEN %u %u ", hdrlen, ah->hdrlen); - pr_debug("RES %04X ", ah->reserved); - pr_debug("SPI %u %08X\n", ntohl(ah->spi), ntohl(ah->spi)); - - pr_debug("IPv6 AH spi %02X ", - spi_match(ahinfo->spis[0], ahinfo->spis[1], - ntohl(ah->spi), - !!(ahinfo->invflags & IP6T_AH_INV_SPI))); - pr_debug("len %02X %04X %02X ", - ahinfo->hdrlen, hdrlen, - (!ahinfo->hdrlen \|\| - (ahinfo->hdrlen == hdrlen) ^ - !!(ahinfo->invflags & IP6T_AH_INV_LEN))); - pr_debug("res %02X %04X %02X\n", - ahinfo->hdrres, ah->reserved, - !(ahinfo->hdrres && ah->reserved)); - return spi_match(ahinfo->spis[0], ahinfo->spis[1], ntohl(ah->spi), !!(ahinfo->invflags & IP6T_AH_INV_SPI)) && @@ -93,7 +70,7 @@ static int ah_mt6_check(const struct xt_mtchk_param par) const struct ip6t_ah ahinfo = par->matchinfo; if (ahinfo->invflags & ~IP6T_AH_INV_MASK) { - pr_debug("unknown flags %X\n", ahinfo->invflags); + pr_info_ratelimited("unknown flags %X\n", ahinfo->invflags); return -EINVAL; } return 0; diff --git a/net/ipv6/netfilter/ip6t_frag.c b/net/ipv6/netfilter/ip6t_frag.c index 3aad6439386b1..f5f3cfb8704cf 100644 --- a/net/ipv6/netfilter/ip6t_frag.c +++ b/net/ipv6/netfilter/ip6t_frag.c @@ -23,12 +23,7 @@ MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>"); static inline bool id_match(u_int32_t min, u_int32_t max, u_int32_t id, bool invert) { - bool r; - pr_debug("id_match:%c 0x%x <= 0x%x <= 0x%x\n", invert ? '!' : ' ', - min, id, max); - r = (id >= min && id <= max) ^ invert; - pr_debug(" result %s\n", r ? "PASS" : "FAILED"); - return r; + return (id >= min && id <= max) ^ invert; } static bool @@ -53,38 +48,6 @@ frag_mt6(const struct sk_buff skb, struct xt_action_param par) return false; } - pr_debug("INFO %04X ", fh->frag_off); - pr_debug("OFFSET %04X ", ntohs(fh->frag_off) & ~0x7); - pr_debug("RES %02X %04X", fh->reserved, ntohs(fh->frag_off) & 0x6); - pr_debug("MF %04X ", fh->frag_off & htons(IP6_MF)); - pr_debug("ID %u %08X\n", ntohl(fh->identification), - ntohl(fh->identification)); - - pr_debug("IPv6 FRAG id %02X ", - id_match(fraginfo->ids[0], fraginfo->ids[1], - ntohl(fh->identification), - !!(fraginfo->invflags & IP6T_FRAG_INV_IDS))); - pr_debug("res %02X %02X%04X %02X ", - fraginfo->flags & IP6T_FRAG_RES, fh->reserved, - ntohs(fh->frag_off) & 0x6, - !((fraginfo->flags & IP6T_FRAG_RES) && - (fh->reserved \|\| (ntohs(fh->frag_off) & 0x06)))); - pr_debug("first %02X %02X %02X ", - fraginfo->flags & IP6T_FRAG_FST, - ntohs(fh->frag_off) & ~0x7, - !((fraginfo->flags & IP6T_FRAG_FST) && - (ntohs(fh->frag_off) & ~0x7))); - pr_debug("mf %02X %02X %02X ", - fraginfo->flags & IP6T_FRAG_MF, - ntohs(fh->frag_off) & IP6_MF, - !((fraginfo->flags & IP6T_FRAG_MF) && - !((ntohs(fh->frag_off) & IP6_MF)))); - pr_debug("last %02X %02X %02X\n", - fraginfo->flags & IP6T_FRAG_NMF, - ntohs(fh->frag_off) & IP6_MF, - !((fraginfo->flags & IP6T_FRAG_NMF) && - (ntohs(fh->frag_off) & IP6_MF))); - return id_match(fraginfo->ids[0], fraginfo->ids[1], ntohl(fh->identification), !!(fraginfo->invflags & IP6T_FRAG_INV_IDS)) && @@ -103,7 +66,7 @@ static int frag_mt6_check(const struct xt_mtchk_param par) const struct ip6t_frag fraginfo = par->matchinfo; if (fraginfo->invflags & ~IP6T_FRAG_INV_MASK) { - pr_debug("unknown flags %X\n", fraginfo->invflags); + pr_info_ratelimited("unknown flags %X\n", fraginfo->invflags); return -EINVAL; } return 0; diff --git a/net/ipv6/netfilter/ip6t_hbh.c b/net/ipv6/netfilter/ip6t_hbh.c index 6d1a5d2026a67..37c207d3152a4 100644 --- a/net/ipv6/netfilter/ip6t_hbh.c +++ b/net/ipv6/netfilter/ip6t_hbh.c @@ -79,14 +79,6 @@ hbh_mt6(const struct sk_buff skb, struct xt_action_param par) return false; } - pr_debug("IPv6 OPTS LEN %u %u ", hdrlen, oh->hdrlen); - - pr_debug("len %02X %04X %02X ", - optinfo->hdrlen, hdrlen, - (!(optinfo->flags & IP6T_OPTS_LEN) \|\| - ((optinfo->hdrlen == hdrlen) ^ - !!(optinfo->invflags & IP6T_OPTS_INV_LEN)))); - ret = (!(optinfo->flags & IP6T_OPTS_LEN) \|\| ((optinfo->hdrlen == hdrlen) ^ !!(optinfo->invflags & IP6T_OPTS_INV_LEN))); @@ -96,8 +88,6 @@ hbh_mt6(const struct sk_buff skb, struct xt_action_param par) if (!(optinfo->flags & IP6T_OPTS_OPTS)) { return ret; } else { - pr_debug("Strict "); - pr_debug("#%d ", optinfo->optsnr); for (temp = 0; temp < optinfo->optsnr; temp++) { /* type field exists ? / if (hdrlen < 1) @@ -108,13 +98,9 @@ hbh_mt6(const struct sk_buff skb, struct xt_action_param par) break; / Type check / - if (tp != (optinfo->opts[temp] & 0xFF00) >> 8) { - pr_debug("Tbad %02X %02X\n", tp, - (optinfo->opts[temp] & 0xFF00) >> 8); + if (tp != (optinfo->opts[temp] & 0xFF00) >> 8) return false; - } else { - pr_debug("Tok "); - } + /* Length check / if (tp) { u16 spec_len; @@ -129,26 +115,18 @@ hbh_mt6(const struct sk_buff skb, struct xt_action_param par) break; spec_len = optinfo->opts[temp] & 0x00FF; - if (spec_len != 0x00FF && spec_len != lp) { - pr_debug("Lbad %02X %04X\n", lp, - spec_len); + if (spec_len != 0x00FF && spec_len != lp) return false; - } - pr_debug("Lok "); + optlen = lp + 2; } else { - pr_debug("Pad1\n"); optlen = 1; } - /* Step to the next / - pr_debug("len%04X\n", optlen); - if ((ptr > skb->len - optlen \|\| hdrlen < optlen) && - temp < optinfo->optsnr - 1) { - pr_debug("new pointer is too large!\n"); + temp < optinfo->optsnr - 1) break; - } + ptr += optlen; hdrlen -= optlen; } @@ -166,16 +144,16 @@ static int hbh_mt6_check(const struct xt_mtchk_param par) const struct ip6t_opts optsinfo = par->matchinfo; if (optsinfo->invflags & ~IP6T_OPTS_INV_MASK) { - pr_debug("unknown flags %X\n", optsinfo->invflags); + pr_info_ratelimited("unknown flags %X\n", optsinfo->invflags); return -EINVAL; } if (optsinfo->optsnr > IP6T_OPTS_OPTSNR) { - pr_debug("too many supported opts specified\n"); + pr_info_ratelimited("too many supported opts specified\n"); return -EINVAL; } if (optsinfo->flags & IP6T_OPTS_NSTRICT) { - pr_debug("Not strict - not implemented"); + pr_info_ratelimited("Not strict - not implemented"); return -EINVAL; } diff --git a/net/ipv6/netfilter/ip6t_mh.c b/net/ipv6/netfilter/ip6t_mh.c index fd492b69acbc0..ba6dcc7791a09 100644 --- a/net/ipv6/netfilter/ip6t_mh.c +++ b/net/ipv6/netfilter/ip6t_mh.c @@ -42,14 +42,11 @@ static bool mh_mt6(const struct sk_buff skb, struct xt_action_param par) if (mh == NULL) { / We've been asked to examine this packet, and we can't. Hence, no choice but to drop. / - pr_debug("Dropping evil MH tinygram.\n"); par->hotdrop = true; return false; } if (mh->ip6mh_proto != IPPROTO_NONE) { - pr_debug("Dropping invalid MH Payload Proto: %u\n", - mh->ip6mh_proto); par->hotdrop = true; return false; } diff --git a/net/ipv6/netfilter/ip6t_rpfilter.c b/net/ipv6/netfilter/ip6t_rpfilter.c index 67c87a88cde4f..af8d10d49de81 100644 --- a/net/ipv6/netfilter/ip6t_rpfilter.c +++ b/net/ipv6/netfilter/ip6t_rpfilter.c @@ -118,7 +118,7 @@ static int rpfilter_check(const struct xt_mtchk_param par) if (strcmp(par->table, "mangle") != 0 && strcmp(par->table, "raw") != 0) { - pr_info_ratelimited("only valid in \'raw\' or \'mangle\' table, not \'%s\'\n", + pr_info_ratelimited("only valid in \'raw\' or \'mangle\' table\n", par->table); return -EINVAL; } diff --git a/net/ipv6/netfilter/ip6t_rt.c b/net/ipv6/netfilter/ip6t_rt.c index 278b52752f364..0c01ac2746d1f 100644 --- a/net/ipv6/netfilter/ip6t_rt.c +++ b/net/ipv6/netfilter/ip6t_rt.c @@ -155,18 +155,18 @@ static int rt_mt6_check(const struct xt_mtchk_param par) const struct ip6t_rt rtinfo = par->matchinfo; if (rtinfo->invflags & ~IP6T_RT_INV_MASK) { - pr_debug("unknown flags %X\n", rtinfo->invflags); + pr_info_ratelimited("unknown flags %X\n", rtinfo->invflags); return -EINVAL; } if (rtinfo->addrnr > IP6T_RT_HOPS) { - pr_debug("too many addresses specified\n"); + pr_info_ratelimited("too many addresses specified\n"); return -EINVAL; } if ((rtinfo->flags & (IP6T_RT_RES \| IP6T_RT_FST_MASK)) && (!(rtinfo->flags & IP6T_RT_TYP) \|\| (rtinfo->rt_type != 0) \|\| (rtinfo->invflags & IP6T_RT_INV_TYP))) { - pr_debug("`--rt-type 0' required before `--rt-0-'"); + pr_info_ratelimited("`--rt-type 0' required before `--rt-0-'"); return -EINVAL; } diff --git a/net/netfilter/xt_CONNSECMARK.c b/net/netfilter/xt_CONNSECMARK.c index 1494b3ee30e11..4e4436a9104b4 100644 --- a/net/netfilter/xt_CONNSECMARK.c +++ b/net/netfilter/xt_CONNSECMARK.c @@ -87,8 +87,7 @@ static int connsecmark_tg_check(const struct xt_tgchk_param par) if (strcmp(par->table, "mangle") != 0 && strcmp(par->table, "security") != 0) { - pr_info_ratelimited("only valid in \'mangle\' or \'security\' table, not \'%s\'\n", - par->table); + pr_info_ratelimited("only valid in \'mangle\' or \'security\' table\n"); return -EINVAL; } diff --git a/net/netfilter/xt_CT.c b/net/netfilter/xt_CT.c index e78660dfdf4b6..91326014ade1c 100644 --- a/net/netfilter/xt_CT.c +++ b/net/netfilter/xt_CT.c @@ -195,7 +195,8 @@ static int xt_ct_tg_check(const struct xt_tgchk_param par, goto err3; } - if (info->helper[0]) { + if (info->helper[0] && + strnlen(info->helper, sizeof(info->helper)) < sizeof(info->helper)) { if (strnlen(info->helper, sizeof(info->helper)) == sizeof(info->helper)) { ret = -ENAMETOOLONG; goto err3; @@ -206,7 +207,8 @@ static int xt_ct_tg_check(const struct xt_tgchk_param par, goto err3; } - if (info->timeout[0]) { + if (info->timeout[0] && + strnlen(info->timeout, sizeof(info->timeout)) < sizeof(info->timeout)) { if (strnlen(info->timeout, sizeof(info->timeout)) == sizeof(info->timeout)) { ret = -ENAMETOOLONG; goto err4; diff --git a/net/netfilter/xt_IDLETIMER.c b/net/netfilter/xt_IDLETIMER.c index bfcf2d44e93db..15b698ea98aa6 100644 --- a/net/netfilter/xt_IDLETIMER.c +++ b/net/netfilter/xt_IDLETIMER.c @@ -102,8 +102,6 @@ static void idletimer_tg_expired(struct timer_list t) { struct idletimer_tg timer = timer_container_of(timer, t, timer); - pr_debug("timer %s expired\n", timer->attr.attr.name); - schedule_work(&timer->work); } @@ -111,7 +109,6 @@ static void idletimer_tg_alarmproc(struct alarm alarm, ktime_t now) { struct idletimer_tg timer = alarm->data; - pr_debug("alarm %s expired\n", timer->attr.attr.name); schedule_work(&timer->work); } @@ -171,7 +168,7 @@ static int idletimer_tg_create(struct idletimer_tg_info info) ret = sysfs_create_file(idletimer_tg_kobj, &info->timer->attr.attr); if (ret < 0) { - pr_debug("couldn't add file to sysfs"); + pr_info_ratelimited("couldn't add file to sysfs"); goto out_free_attr; } @@ -220,7 +217,7 @@ static int idletimer_tg_create_v1(struct idletimer_tg_info_v1 info) ret = sysfs_create_file(idletimer_tg_kobj, &info->timer->attr.attr); if (ret < 0) { - pr_debug("couldn't add file to sysfs"); + pr_info_ratelimited("couldn't add file to sysfs"); goto out_free_attr; } @@ -228,7 +225,6 @@ static int idletimer_tg_create_v1(struct idletimer_tg_info_v1 info) kobject_uevent(idletimer_tg_kobj,KOBJ_ADD); list_add(&info->timer->entry, &idletimer_tg_list); - pr_debug("timer type value is %u", info->timer_type); info->timer->timer_type = info->timer_type; info->timer->refcnt = 1; @@ -263,9 +259,6 @@ static unsigned int idletimer_tg_target(struct sk_buff skb, { const struct idletimer_tg_info info = par->targinfo; - pr_debug("resetting timer %s, timeout period %u\n", - info->label, info->timeout); - mod_timer(&info->timer->timer, secs_to_jiffies(info->timeout) + jiffies); @@ -280,9 +273,6 @@ static unsigned int idletimer_tg_target_v1(struct sk_buff skb, { const struct idletimer_tg_info_v1 info = par->targinfo; - pr_debug("resetting timer %s, timeout period %u\n", - info->label, info->timeout); - if (info->timer->timer_type & XT_IDLETIMER_ALARM) { idletimer_start_alarm_sec(info->timer, info->timeout); } else { @@ -296,17 +286,17 @@ static unsigned int idletimer_tg_target_v1(struct sk_buff skb, static int idletimer_tg_helper(struct idletimer_tg_info info) { if (info->timeout == 0) { - pr_debug("timeout value is zero\n"); + pr_info_ratelimited("timeout value is zero\n"); return -EINVAL; } if (info->timeout >= INT_MAX / 1000) { - pr_debug("timeout value is too big\n"); + pr_info_ratelimited("timeout value is too big\n"); return -EINVAL; } if (info->label[0] == '\0' \|\| strnlen(info->label, MAX_IDLETIMER_LABEL_SIZE) == MAX_IDLETIMER_LABEL_SIZE) { - pr_debug("label is empty or not nul-terminated\n"); + pr_info_ratelimited("label is empty or not nul-terminated\n"); return -EINVAL; } return 0; @@ -318,34 +308,25 @@ static int idletimer_tg_checkentry(const struct xt_tgchk_param par) struct idletimer_tg_info info = par->targinfo; int ret; - pr_debug("checkentry targinfo%s\n", info->label); - ret = idletimer_tg_helper(info); if(ret < 0) - { - pr_debug("checkentry helper return invalid\n"); return -EINVAL; - } mutex_lock(&list_mutex); info->timer = __idletimer_tg_find_by_label(info->label); if (info->timer) { if (info->timer->timer_type & XT_IDLETIMER_ALARM) { - pr_debug("Adding/Replacing rule with same label and different timer type is not allowed\n"); mutex_unlock(&list_mutex); + pr_info_ratelimited("Adding/Replacing rule with same label and different timer type is not allowed\n"); return -EINVAL; } info->timer->refcnt++; mod_timer(&info->timer->timer, secs_to_jiffies(info->timeout) + jiffies); - - pr_debug("increased refcnt of timer %s to %u\n", - info->label, info->timer->refcnt); } else { ret = idletimer_tg_create(info); if (ret < 0) { - pr_debug("failed to create timer\n"); mutex_unlock(&list_mutex); return ret; } @@ -360,30 +341,23 @@ static int idletimer_tg_checkentry_v1(const struct xt_tgchk_param par) struct idletimer_tg_info_v1 info = par->targinfo; int ret; - pr_debug("checkentry targinfo%s\n", info->label); - if (info->send_nl_msg) return -EOPNOTSUPP; ret = idletimer_tg_helper((struct idletimer_tg_info )info); if(ret < 0) - { - pr_debug("checkentry helper return invalid\n"); return -EINVAL; - } - if (info->timer_type > XT_IDLETIMER_ALARM) { - pr_debug("invalid value for timer type\n"); + if (info->timer_type > XT_IDLETIMER_ALARM) return -EINVAL; - } mutex_lock(&list_mutex); info->timer = __idletimer_tg_find_by_label(info->label); if (info->timer) { if (info->timer->timer_type != info->timer_type) { - pr_debug("Adding/Replacing rule with same label and different timer type is not allowed\n"); mutex_unlock(&list_mutex); + pr_info_ratelimited("Adding/Replacing rule with same label and different timer type is not allowed\n"); return -EINVAL; } @@ -393,21 +367,15 @@ static int idletimer_tg_checkentry_v1(const struct xt_tgchk_param par) ktime_t tout = alarm_expires_remaining(&info->timer->alarm); struct timespec64 ktimespec = ktime_to_timespec64(tout); - if (ktimespec.tv_sec > 0) { - pr_debug("time_expiry_remaining %lld\n", - ktimespec.tv_sec); + if (ktimespec.tv_sec > 0) idletimer_start_alarm_ktime(info->timer, tout); - } } else { mod_timer(&info->timer->timer, secs_to_jiffies(info->timeout) + jiffies); } - pr_debug("increased refcnt of timer %s to %u\n", - info->label, info->timer->refcnt); } else { ret = idletimer_tg_create_v1(info); if (ret < 0) { - pr_debug("failed to create timer\n"); mutex_unlock(&list_mutex); return ret; } @@ -421,19 +389,13 @@ static void idletimer_tg_destroy(const struct xt_tgdtor_param par) { const struct idletimer_tg_info info = par->targinfo; - pr_debug("destroy targinfo %s\n", info->label); - mutex_lock(&list_mutex); if (--info->timer->refcnt > 0) { - pr_debug("decreased refcnt of timer %s to %u\n", - info->label, info->timer->refcnt); mutex_unlock(&list_mutex); return; } - pr_debug("deleting timer %s\n", info->label); - list_del(&info->timer->entry); mutex_unlock(&list_mutex); @@ -448,19 +410,13 @@ static void idletimer_tg_destroy_v1(const struct xt_tgdtor_param par) { const struct idletimer_tg_info_v1 info = par->targinfo; - pr_debug("destroy targinfo %s\n", info->label); - mutex_lock(&list_mutex); if (--info->timer->refcnt > 0) { - pr_debug("decreased refcnt of timer %s to %u\n", - info->label, info->timer->refcnt); mutex_unlock(&list_mutex); return; } - pr_debug("deleting timer %s\n", info->label); - list_del(&info->timer->entry); mutex_unlock(&list_mutex); @@ -534,7 +490,7 @@ static int __init idletimer_tg_init(void) idletimer_tg_class = class_create("xt_idletimer"); err = PTR_ERR(idletimer_tg_class); if (IS_ERR(idletimer_tg_class)) { - pr_debug("couldn't register device class\n"); + pr_info_ratelimited("couldn't register device class\n"); goto out; } @@ -542,7 +498,7 @@ static int __init idletimer_tg_init(void) MKDEV(0, 0), NULL, "timers"); err = PTR_ERR(idletimer_tg_device); if (IS_ERR(idletimer_tg_device)) { - pr_debug("couldn't register system device\n"); + pr_info_ratelimited("couldn't register system device\n"); goto out_class; } @@ -551,7 +507,7 @@ static int __init idletimer_tg_init(void) err = xt_register_targets(idletimer_tg, ARRAY_SIZE(idletimer_tg)); if (err < 0) { - pr_debug("couldn't register xt target\n"); + pr_info_ratelimited("couldn't register xt target\n"); goto out_dev; } diff --git a/net/netfilter/xt_LOG.c b/net/netfilter/xt_LOG.c index f39244f9c0ed9..de3f176792a07 100644 --- a/net/netfilter/xt_LOG.c +++ b/net/netfilter/xt_LOG.c @@ -50,12 +50,12 @@ static int log_tg_check(const struct xt_tgchk_param par) return -EINVAL; if (loginfo->level >= 8) { - pr_debug("level %u >= 8\n", loginfo->level); + pr_info_ratelimited("level %u >= 8\n", loginfo->level); return -EINVAL; } if (loginfo->prefix[sizeof(loginfo->prefix)-1] != '\0') { - pr_debug("prefix is not null-terminated\n"); + pr_info_ratelimited("prefix is not null-terminated\n"); return -EINVAL; } diff --git a/net/netfilter/xt_MASQUERADE.c b/net/netfilter/xt_MASQUERADE.c index eae05c1783367..cea488cec5445 100644 --- a/net/netfilter/xt_MASQUERADE.c +++ b/net/netfilter/xt_MASQUERADE.c @@ -21,11 +21,11 @@ static int masquerade_tg_check(const struct xt_tgchk_param par) const struct nf_nat_ipv4_multi_range_compat mr = par->targinfo; if (mr->range[0].flags & NF_NAT_RANGE_MAP_IPS) { - pr_debug("bad MAP_IPS.\n"); + pr_info_ratelimited("bad MAP_IPS.\n"); return -EINVAL; } if (mr->rangesize != 1) { - pr_debug("bad rangesize %u\n", mr->rangesize); + pr_info_ratelimited("bad rangesize %u\n", mr->rangesize); return -EINVAL; } return nf_ct_netns_get(par->net, par->family); diff --git a/net/netfilter/xt_NETMAP.c b/net/netfilter/xt_NETMAP.c index cb2ee80d84fa8..8c86d9a43373a 100644 --- a/net/netfilter/xt_NETMAP.c +++ b/net/netfilter/xt_NETMAP.c @@ -106,11 +106,11 @@ static int netmap_tg4_check(const struct xt_tgchk_param par) const struct nf_nat_ipv4_multi_range_compat mr = par->targinfo; if (!(mr->range[0].flags & NF_NAT_RANGE_MAP_IPS)) { - pr_debug("bad MAP_IPS.\n"); + pr_info_ratelimited("bad MAP_IPS.\n"); return -EINVAL; } if (mr->rangesize != 1) { - pr_debug("bad rangesize %u.\n", mr->rangesize); + pr_info_ratelimited("bad rangesize %u.\n", mr->rangesize); return -EINVAL; } return nf_ct_netns_get(par->net, par->family); diff --git a/net/netfilter/xt_REDIRECT.c b/net/netfilter/xt_REDIRECT.c index ff66b56a3f97d..27bc0545c4f74 100644 --- a/net/netfilter/xt_REDIRECT.c +++ b/net/netfilter/xt_REDIRECT.c @@ -51,11 +51,11 @@ static int redirect_tg4_check(const struct xt_tgchk_param par) const struct nf_nat_ipv4_multi_range_compat mr = par->targinfo; if (mr->range[0].flags & NF_NAT_RANGE_MAP_IPS) { - pr_debug("bad MAP_IPS.\n"); + pr_info_ratelimited("bad MAP_IPS.\n"); return -EINVAL; } if (mr->rangesize != 1) { - pr_debug("bad rangesize %u.\n", mr->rangesize); + pr_info_ratelimited("bad rangesize %u.\n", mr->rangesize); return -EINVAL; } return nf_ct_netns_get(par->net, par->family); diff --git a/net/netfilter/xt_SECMARK.c b/net/netfilter/xt_SECMARK.c index 5bc5ea505eb9e..38e8e410b4e81 100644 --- a/net/netfilter/xt_SECMARK.c +++ b/net/netfilter/xt_SECMARK.c @@ -79,8 +79,7 @@ secmark_tg_check(const char table, struct xt_secmark_target_info_v1 info) if (strcmp(table, "mangle") != 0 && strcmp(table, "security") != 0) { - pr_info_ratelimited("only valid in \'mangle\' or \'security\' table, not \'%s\'\n", - table); + pr_info_ratelimited("only valid in \'mangle\' or \'security\' table\n"); return -EINVAL; } diff --git a/net/netfilter/xt_cgroup.c b/net/netfilter/xt_cgroup.c index 43d2ae2be628d..ac1b7e71cd7f5 100644 --- a/net/netfilter/xt_cgroup.c +++ b/net/netfilter/xt_cgroup.c @@ -33,7 +33,7 @@ static int cgroup_mt_check_v0(const struct xt_mtchk_param par) return -EINVAL; if (!IS_ENABLED(CONFIG_CGROUP_NET_CLASSID)) { - pr_info(NET_CLS_CLASSID_INVALID_MSG); + pr_info_ratelimited(NET_CLS_CLASSID_INVALID_MSG); return -EINVAL; } @@ -49,7 +49,7 @@ static int cgroup_mt_check_v1(const struct xt_mtchk_param par) return -EINVAL; if (!info->has_path && !info->has_classid) { - pr_info("xt_cgroup: no path or classid specified\n"); + pr_info_ratelimited("xt_cgroup: no path or classid specified\n"); return -EINVAL; } @@ -59,7 +59,7 @@ static int cgroup_mt_check_v1(const struct xt_mtchk_param par) } if (info->has_classid && !IS_ENABLED(CONFIG_CGROUP_NET_CLASSID)) { - pr_info(NET_CLS_CLASSID_INVALID_MSG); + pr_info_ratelimited(NET_CLS_CLASSID_INVALID_MSG); return -EINVAL; } @@ -89,7 +89,7 @@ static int cgroup_mt_check_v2(const struct xt_mtchk_param par) return -EINVAL; if (!info->has_path && !info->has_classid) { - pr_info("xt_cgroup: no path or classid specified\n"); + pr_info_ratelimited("xt_cgroup: no path or classid specified\n"); return -EINVAL; } @@ -99,7 +99,7 @@ static int cgroup_mt_check_v2(const struct xt_mtchk_param par) } if (info->has_classid && !IS_ENABLED(CONFIG_CGROUP_NET_CLASSID)) { - pr_info(NET_CLS_CLASSID_INVALID_MSG); + pr_info_ratelimited(NET_CLS_CLASSID_INVALID_MSG); return -EINVAL; } diff --git a/net/netfilter/xt_esp.c b/net/netfilter/xt_esp.c index 2a1c0ad0ff079..68fd75884268a 100644 --- a/net/netfilter/xt_esp.c +++ b/net/netfilter/xt_esp.c @@ -25,12 +25,7 @@ MODULE_ALIAS("ip6t_esp"); static inline bool spi_match(u_int32_t min, u_int32_t max, u_int32_t spi, bool invert) { - bool r; - pr_debug("spi_match:%c 0x%x <= 0x%x <= 0x%x\n", - invert ? '!' : ' ', min, spi, max); - r = (spi >= min && spi <= max) ^ invert; - pr_debug(" result %s\n", r ? "PASS" : "FAILED"); - return r; + return (spi >= min && spi <= max) ^ invert; } static bool esp_mt(const struct sk_buff skb, struct xt_action_param par) @@ -48,7 +43,6 @@ static bool esp_mt(const struct sk_buff skb, struct xt_action_param par) /* We've been asked to examine this packet, and we * can't. Hence, no choice but to drop. / - pr_debug("Dropping evil ESP tinygram.\n"); par->hotdrop = true; return false; } @@ -62,7 +56,7 @@ static int esp_mt_check(const struct xt_mtchk_param par) const struct xt_esp espinfo = par->matchinfo; if (espinfo->invflags & ~XT_ESP_INV_MASK) { - pr_debug("unknown flags %X\n", espinfo->invflags); + pr_info_ratelimited("unknown flags %X\n", espinfo->invflags); return -EINVAL; } diff --git a/net/netfilter/xt_ipcomp.c b/net/netfilter/xt_ipcomp.c index 472da639a32e2..3299c1ea60f9e 100644 --- a/net/netfilter/xt_ipcomp.c +++ b/net/netfilter/xt_ipcomp.c @@ -29,12 +29,7 @@ MODULE_ALIAS("ip6t_ipcomp"); static inline bool spi_match(u_int32_t min, u_int32_t max, u_int32_t spi, bool invert) { - bool r; - pr_debug("spi_match:%c 0x%x <= 0x%x <= 0x%x\n", - invert ? '!' : ' ', min, spi, max); - r = (spi >= min && spi <= max) ^ invert; - pr_debug(" result %s\n", r ? "PASS" : "FAILED"); - return r; + return (spi >= min && spi <= max) ^ invert; } static bool comp_mt(const struct sk_buff skb, struct xt_action_param par) @@ -52,7 +47,6 @@ static bool comp_mt(const struct sk_buff skb, struct xt_action_param par) / We've been asked to examine this packet, and we * can't. Hence, no choice but to drop. / - pr_debug("Dropping evil IPComp tinygram.\n"); par->hotdrop = true; return false; } diff --git a/net/netfilter/xt_iprange.c b/net/netfilter/xt_iprange.c index 0c9e014e30b49..bf61141fb7850 100644 --- a/net/netfilter/xt_iprange.c +++ b/net/netfilter/xt_iprange.c @@ -24,27 +24,15 @@ iprange_mt4(const struct sk_buff skb, struct xt_action_param par) m = ntohl(iph->saddr) < ntohl(info->src_min.ip); m \|= ntohl(iph->saddr) > ntohl(info->src_max.ip); m ^= !!(info->flags & IPRANGE_SRC_INV); - if (m) { - pr_debug("src IP %pI4 NOT in range %s%pI4-%pI4\n", - &iph->saddr, - (info->flags & IPRANGE_SRC_INV) ? "(INV) " : "", - &info->src_min.ip, - &info->src_max.ip); + if (m) return false; - } } if (info->flags & IPRANGE_DST) { m = ntohl(iph->daddr) < ntohl(info->dst_min.ip); m \|= ntohl(iph->daddr) > ntohl(info->dst_max.ip); m ^= !!(info->flags & IPRANGE_DST_INV); - if (m) { - pr_debug("dst IP %pI4 NOT in range %s%pI4-%pI4\n", - &iph->daddr, - (info->flags & IPRANGE_DST_INV) ? "(INV) " : "", - &info->dst_min.ip, - &info->dst_max.ip); + if (m) return false; - } } return true; } @@ -73,27 +61,15 @@ iprange_mt6(const struct sk_buff skb, struct xt_action_param par) m = iprange_ipv6_lt(&iph->saddr, &info->src_min.in6); m \|= iprange_ipv6_lt(&info->src_max.in6, &iph->saddr); m ^= !!(info->flags & IPRANGE_SRC_INV); - if (m) { - pr_debug("src IP %pI6 NOT in range %s%pI6-%pI6\n", - &iph->saddr, - (info->flags & IPRANGE_SRC_INV) ? "(INV) " : "", - &info->src_min.in6, - &info->src_max.in6); + if (m) return false; - } } if (info->flags & IPRANGE_DST) { m = iprange_ipv6_lt(&iph->daddr, &info->dst_min.in6); m \|= iprange_ipv6_lt(&info->dst_max.in6, &iph->daddr); m ^= !!(info->flags & IPRANGE_DST_INV); - if (m) { - pr_debug("dst IP %pI6 NOT in range %s%pI6-%pI6\n", - &iph->daddr, - (info->flags & IPRANGE_DST_INV) ? "(INV) " : "", - &info->dst_min.in6, - &info->dst_max.in6); + if (m) return false; - } } return true; } diff --git a/net/netfilter/xt_ipvs.c b/net/netfilter/xt_ipvs.c index 253c71cc9a634..e13c0ffb73a9a 100644 --- a/net/netfilter/xt_ipvs.c +++ b/net/netfilter/xt_ipvs.c @@ -148,7 +148,6 @@ ipvs_mt(const struct sk_buff skb, struct xt_action_param par) out_put_cp: __ip_vs_conn_put(cp); out: - pr_debug("match=%d\n", match); return match; } diff --git a/net/netfilter/xt_multiport.c b/net/netfilter/xt_multiport.c index a1691ff405d3c..bff5f53a9befb 100644 --- a/net/netfilter/xt_multiport.c +++ b/net/netfilter/xt_multiport.c @@ -37,7 +37,6 @@ ports_match_v1(const struct xt_multiport_v1 minfo, if (minfo->pflags[i]) { /* range port matching / e = minfo->ports[++i]; - pr_debug("src or dst matches with %d-%d?\n", s, e); switch (minfo->flags) { case XT_MULTIPORT_SOURCE: @@ -58,8 +57,6 @@ ports_match_v1(const struct xt_multiport_v1 minfo, } } else { /* exact port matching / - pr_debug("src or dst matches with %d?\n", s); - switch (minfo->flags) { case XT_MULTIPORT_SOURCE: if (src == s) @@ -97,7 +94,6 @@ multiport_mt(const struct sk_buff skb, struct xt_action_param par) / We've been asked to examine this packet, and we * can't. Hence, no choice but to drop. / - pr_debug("Dropping evil offset=0 tinygram.\n"); par->hotdrop = true; return false; } diff --git a/net/netfilter/xt_sctp.c b/net/netfilter/xt_sctp.c index b46a6a5120583..d35c21d9651b0 100644 --- a/net/netfilter/xt_sctp.c +++ b/net/netfilter/xt_sctp.c @@ -48,30 +48,17 @@ match_packet(const struct sk_buff skb, const struct xt_sctp_flag_info flag_info = info->flag_info; int flag_count = info->flag_count; -#ifdef DEBUG - int i = 0; -#endif - if (chunk_match_type == SCTP_CHUNK_MATCH_ALL) SCTP_CHUNKMAP_COPY(chunkmapcopy, info->chunkmap); do { sch = skb_header_pointer(skb, offset, sizeof(_sch), &_sch); if (sch == NULL \|\| sch->length == 0) { - pr_debug("Dropping invalid SCTP packet.\n"); hotdrop = true; return false; } -#ifdef DEBUG - pr_debug("Chunk num: %d\toffset: %d\ttype: %d\tlength: %d" - "\tflags: %x\n", - ++i, offset, sch->type, htons(sch->length), - sch->flags); -#endif offset += SCTP_PAD4(ntohs(sch->length)); - pr_debug("skb->len: %d\toffset: %d\n", skb->len, offset); - if (SCTP_CHUNKMAP_IS_SET(info->chunkmap, sch->type)) { switch (chunk_match_type) { case SCTP_CHUNK_MATCH_ANY: @@ -121,18 +108,14 @@ sctp_mt(const struct sk_buff skb, struct xt_action_param par) const struct sctphdr sh; struct sctphdr _sh; - if (par->fragoff != 0) { - pr_debug("Dropping non-first fragment.. FIXME\n"); + if (par->fragoff != 0) return false; - } sh = skb_header_pointer(skb, par->thoff, sizeof(_sh), &_sh); if (sh == NULL) { - pr_debug("Dropping evil TCP offset=0 tinygram.\n"); par->hotdrop = true; return false; } - pr_debug("spt: %d\tdpt: %d\n", ntohs(sh->source), ntohs(sh->dest)); return SCCHECK(ntohs(sh->source) >= info->spts[0] && ntohs(sh->source) <= info->spts[1], diff --git a/net/netfilter/xt_tcpudp.c b/net/netfilter/xt_tcpudp.c index f76cf18f1a244..70608b8d06ab2 100644 --- a/net/netfilter/xt_tcpudp.c +++ b/net/netfilter/xt_tcpudp.c @@ -44,8 +44,6 @@ tcp_find_option(u_int8_t option, u_int8_t _opt[60 - sizeof(struct tcphdr)]; unsigned int i; - pr_debug("finding option\n"); - if (!optlen) return invert; @@ -81,10 +79,8 @@ static bool tcp_mt(const struct sk_buff skb, struct xt_action_param par) causes this. Its a cracker trying to break in by doing a flag overwrite to pass the direction checks. / - if (par->fragoff == 1) { - pr_debug("Dropping evil TCP offset=1 frag.\n"); + if (par->fragoff == 1) par->hotdrop = true; - } /* Must not be a fragment. / return false; } @@ -93,7 +89,6 @@ static bool tcp_mt(const struct sk_buff skb, struct xt_action_param par) if (th == NULL) { / We've been asked to examine this packet, and we can't. Hence, no choice but to drop. / - pr_debug("Dropping evil TCP offset=0 tinygram.\n"); par->hotdrop = true; return false; } @@ -145,7 +140,6 @@ static bool udp_mt(const struct sk_buff skb, struct xt_action_param par) if (uh == NULL) { / We've been asked to examine this packet, and we can't. Hence, no choice but to drop. */ - pr_debug("Dropping evil UDP tinygram.\n"); par->hotdrop = true; return false; }
23/3	2026/08/18 14:41	llm	kmsan-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 16918 output: 222 thoughts: 3053 Thoughts: Analysis of Netfilter Patch Series: Primarily Logging Cleanup with a Glitch Okay, here's the deal. I'm looking at this patch series, and the main thing it's doing is removing a bunch of `pr_debug` calls and converting some of them to `pr_info_ratelimited` calls across a bunch of netfilter modules: `ipt_ah.c`, `ipt_rpfilter.c`, `ip6t_ah.c`, etc. Basically, it's a code cleanup, which is fine. Nothing too exciting, just making things a bit less chatty. Then I hit this odd change in `xt_CT.c`. They've messed with the code that handles the `helper` string: ```c - if (info->helper[0]) { + if (info->helper[0] && + strnlen(info->helper, sizeof(info->helper)) < sizeof(info->helper)) { ``` I see that. Adding `strnlen` condition before the original condition. And then there's more after: ```c if (strnlen(info->helper, sizeof(info->helper)) == sizeof(info->helper)) { ret = -ENAMETOOLONG; goto err3; } ``` Wait a second... If that `strnlen` is less than `sizeof`, then the inner `if` condition will never be true, right? Because if it's less, the string is null-terminated, so the length can't be equal to the buffer size. That inner `if` is essentially dead code now. Seems like a logic error. Original code should've returned `-ENAMETOOLONG` if the string wasn't null-terminated. But now, with the added check, that case just gets skipped. Is there a KMSAN issue here? I need to confirm the code: ```c - if (info->helper[0]) { + if (info->helper[0] && + strnlen(info->helper, sizeof(info->helper)) < sizeof(info->helper)) { if (strnlen(info->helper, sizeof(info->helper)) == sizeof(info->helper)) { ret = -ENAMETOOLONG; goto err3; } ``` Yeah! If the string is not null-terminated, it just skips the whole block. It doesn't return the `-ENAMETOOLONG` as it should. This seems like a bug introduced by the patch, not a fix. It skips the error checking and the helper loading when the string isn't null-terminated. Okay, is there an uninitialized memory read here? Let me check the exact diff: ```c - if (info->helper[0]) { + if (info->helper[0] && + strnlen(info->helper, sizeof(info->helper)) < sizeof(info->helper)) { ``` No, it doesn't look like it because it's still checking the first character `info->helper[0]`. So if the string isn't fully initialized from the user's side, `strnlen` will still read it to determine the length. But... the memory for `info->helper` comes from `par->targinfo`, right? That's from userspace. If `info->helper` isn't null-terminated, `strnlen` might read it. Is `info` fully initialized from userspace? Let me double-check. The code uses `copy_from_user`. So, yes! Because userspace is writing to the kernel, so KMSAN should not complain, as it marks all the memory copied from userspace as initialized! So, it initializes it as far as the kernel is concerned. Let's look at the other changes... removing `pr_debug`. Nothing to see there. So, in summary, this patch is mostly a cleanup, removing `pr_debug` and changing some to `pr_info_ratelimited`. The `xt_CT.c` change does have a logic error, in that it skips error checking. It makes the inner check dead code and changes behavior for non-null-terminated strings. But it doesn't introduce uninitialized memory issues. `info->helper` is initialized because it comes from `copy_from_user`. KMSAN is not an issue here. No need for that fuzzing. The patch has a logic flaw, that's all. And it's probably functional, not a security issue
24/3	2026/08/18 14:42	tool	set-results	0m Args: { "KMSANReasoning": "The patch series primarily removes `pr_debug` statements and converts some to `pr_info_ratelimited` across various netfilter modules. There is also a logical change in `xt_CT.c` regarding the validation of `info-\u003ehelper` and `info-\u003etimeout` strings, which introduces dead code and alters the error handling for non-null-terminated strings. However, the `info` structure (`par-\u003etarginfo`) is populated via `copy_from_user` with data provided by userspace, meaning the memory is fully initialized from the kernel's perspective. The patch does not introduce any new allocations, does not expose kernel memory to userspace, and does not add control flow dependent on uninitialized kernel memory. Any bugs introduced by this patch (such as the logic flaw in `xt_CT.c`) are functional and do not involve uninitialized memory. Therefore, a dedicated KMSAN fuzzing session is not necessary.", "NeedsKMSAN": false } Results: { "KMSANReasoning": "The patch series primarily removes `pr_debug` statements and converts some to `pr_info_ratelimited` across various netfilter modules. There is also a logical change in `xt_CT.c` regarding the validation of `info-\u003ehelper` and `info-\u003etimeout` strings, which introduces dead code and alters the error handling for non-null-terminated strings. However, the `info` structure (`par-\u003etarginfo`) is populated via `copy_from_user` with data provided by userspace, meaning the memory is fully initialized from the kernel's perspective. The patch does not introduce any new allocations, does not expose kernel memory to userspace, and does not add control flow dependent on uninitialized kernel memory. Any bugs introduced by this patch (such as the logic flaw in `xt_CT.c`) are functional and do not involve uninitialized memory. Therefore, a dedicated KMSAN fuzzing session is not necessary.", "NeedsKMSAN": false }

{
  "EnableConfigs": [
    "NETFILTER_XT_TARGET_CT",
    "NETFILTER_XT_TARGET_IDLETIMER",
    "NF_CONNTRACK",
    "IP_NF_RAW",
    "NETFILTER_ADVANCED"
  ],
  "FocusSymbols": [
    "xt_ct_tg_check",
    "idletimer_tg_checkentry",
    "idletimer_tg_checkentry_v1"
  ],
  "KMSANReasoning": "The patch series primarily removes `pr_debug` statements and converts some to `pr_info_ratelimited` across various netfilter modules. There is also a logical change in `xt_CT.c` regarding the validation of `info-\u003ehelper` and `info-\u003etimeout` strings, which introduces dead code and alters the error handling for non-null-terminated strings. However, the `info` structure (`par-\u003etarginfo`) is populated via `copy_from_user` with data provided by userspace, meaning the memory is fully initialized from the kernel's perspective. The patch does not introduce any new allocations, does not expose kernel memory to userspace, and does not add control flow dependent on uninitialized kernel memory. Any bugs introduced by this patch (such as the logic flaw in `xt_CT.c`) are functional and do not involve uninitialized memory. Therefore, a dedicated KMSAN fuzzing session is not necessary.",
  "NeedsKMSAN": false,
  "Reasoning": "The patch modifies `xt_CT.c` to change the validation logic for `info-\u003ehelper` and `info-\u003etimeout`. If they are not null-terminated, the new code skips setting them instead of returning `-ENAMETOOLONG`, which is a functional change in the target initialization logic. The patch also modifies `xt_IDLETIMER.c` to release a mutex before logging, which is a minor functional change. These changes alter the execution flow and are reachable from userspace via netfilter configuration.",
  "WorthFuzzing": true
}

{
  "PatchDiff": "commit 9338aec55ce1ed0fef018b0c87a6ae341b6a6a77\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Tue Aug 18 14:39:20 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/net/ipv4/netfilter/ipt_ah.c b/net/ipv4/netfilter/ipt_ah.c\nindex 161ba412cb08b..7131f297ada2e 100644\n--- a/net/ipv4/netfilter/ipt_ah.c\n+++ b/net/ipv4/netfilter/ipt_ah.c\n@@ -19,12 +19,7 @@ MODULE_DESCRIPTION(\"Xtables: IPv4 IPsec-AH SPI match\");\n static inline bool\n spi_match(u_int32_t min, u_int32_t max, u_int32_t spi, bool invert)\n {\n-\tbool r;\n-\tpr_debug(\"spi_match:%c 0x%x \u003c= 0x%x \u003c= 0x%x\\n\",\n-\t\t invert ? '!' : ' ', min, spi, max);\n-\tr = (spi \u003e= min \u0026\u0026 spi \u003c= max) ^ invert;\n-\tpr_debug(\" result %s\\n\", r ? \"PASS\" : \"FAILED\");\n-\treturn r;\n+\treturn (spi \u003e= min \u0026\u0026 spi \u003c= max) ^ invert;\n }\n \n static bool ah_mt(const struct sk_buff *skb, struct xt_action_param *par)\n@@ -42,7 +37,6 @@ static bool ah_mt(const struct sk_buff *skb, struct xt_action_param *par)\n \t\t/* We've been asked to examine this packet, and we\n \t\t * can't.  Hence, no choice but to drop.\n \t\t */\n-\t\tpr_debug(\"Dropping evil AH tinygram.\\n\");\n \t\tpar-\u003ehotdrop = true;\n \t\treturn false;\n \t}\n@@ -58,7 +52,7 @@ static int ah_mt_check(const struct xt_mtchk_param *par)\n \n \t/* Must specify no unknown invflags */\n \tif (ahinfo-\u003einvflags \u0026 ~IPT_AH_INV_MASK) {\n-\t\tpr_debug(\"unknown flags %X\\n\", ahinfo-\u003einvflags);\n+\t\tpr_info_ratelimited(\"unknown flags %X\\n\", ahinfo-\u003einvflags);\n \t\treturn -EINVAL;\n \t}\n \treturn 0;\ndiff --git a/net/ipv4/netfilter/ipt_rpfilter.c b/net/ipv4/netfilter/ipt_rpfilter.c\nindex 6d9bf51068684..2c38fd6624aa1 100644\n--- a/net/ipv4/netfilter/ipt_rpfilter.c\n+++ b/net/ipv4/netfilter/ipt_rpfilter.c\n@@ -95,8 +95,7 @@ static int rpfilter_check(const struct xt_mtchk_param *par)\n \n \tif (strcmp(par-\u003etable, \"mangle\") != 0 \u0026\u0026\n \t    strcmp(par-\u003etable, \"raw\") != 0) {\n-\t\tpr_info_ratelimited(\"only valid in \\'raw\\' or \\'mangle\\' table, not \\'%s\\'\\n\",\n-\t\t\t\t    par-\u003etable);\n+\t\tpr_info_ratelimited(\"only valid in \\'raw\\' or \\'mangle\\' table\\n\");\n \t\treturn -EINVAL;\n \t}\n \ndiff --git a/net/ipv6/netfilter/ip6t_ah.c b/net/ipv6/netfilter/ip6t_ah.c\nindex 1258783ed8762..dab7dbc6a675c 100644\n--- a/net/ipv6/netfilter/ip6t_ah.c\n+++ b/net/ipv6/netfilter/ip6t_ah.c\n@@ -24,13 +24,7 @@ MODULE_AUTHOR(\"Andras Kis-Szabo \u003ckisza@sch.bme.hu\u003e\");\n static inline bool\n spi_match(u_int32_t min, u_int32_t max, u_int32_t spi, bool invert)\n {\n-\tbool r;\n-\n-\tpr_debug(\"spi_match:%c 0x%x \u003c= 0x%x \u003c= 0x%x\\n\",\n-\t\t invert ? '!' : ' ', min, spi, max);\n-\tr = (spi \u003e= min \u0026\u0026 spi \u003c= max) ^ invert;\n-\tpr_debug(\" result %s\\n\", r ? \"PASS\" : \"FAILED\");\n-\treturn r;\n+\treturn (spi \u003e= min \u0026\u0026 spi \u003c= max) ^ invert;\n }\n \n static bool ah_mt6(const struct sk_buff *skb, struct xt_action_param *par)\n@@ -62,23 +56,6 @@ static bool ah_mt6(const struct sk_buff *skb, struct xt_action_param *par)\n \t\treturn false;\n \t}\n \n-\tpr_debug(\"IPv6 AH LEN %u %u \", hdrlen, ah-\u003ehdrlen);\n-\tpr_debug(\"RES %04X \", ah-\u003ereserved);\n-\tpr_debug(\"SPI %u %08X\\n\", ntohl(ah-\u003espi), ntohl(ah-\u003espi));\n-\n-\tpr_debug(\"IPv6 AH spi %02X \",\n-\t\t spi_match(ahinfo-\u003espis[0], ahinfo-\u003espis[1],\n-\t\t\t   ntohl(ah-\u003espi),\n-\t\t\t   !!(ahinfo-\u003einvflags \u0026 IP6T_AH_INV_SPI)));\n-\tpr_debug(\"len %02X %04X %02X \",\n-\t\t ahinfo-\u003ehdrlen, hdrlen,\n-\t\t (!ahinfo-\u003ehdrlen ||\n-\t\t  (ahinfo-\u003ehdrlen == hdrlen) ^\n-\t\t  !!(ahinfo-\u003einvflags \u0026 IP6T_AH_INV_LEN)));\n-\tpr_debug(\"res %02X %04X %02X\\n\",\n-\t\t ahinfo-\u003ehdrres, ah-\u003ereserved,\n-\t\t !(ahinfo-\u003ehdrres \u0026\u0026 ah-\u003ereserved));\n-\n \treturn spi_match(ahinfo-\u003espis[0], ahinfo-\u003espis[1],\n \t\t\t  ntohl(ah-\u003espi),\n \t\t\t  !!(ahinfo-\u003einvflags \u0026 IP6T_AH_INV_SPI)) \u0026\u0026\n@@ -93,7 +70,7 @@ static int ah_mt6_check(const struct xt_mtchk_param *par)\n \tconst struct ip6t_ah *ahinfo = par-\u003ematchinfo;\n \n \tif (ahinfo-\u003einvflags \u0026 ~IP6T_AH_INV_MASK) {\n-\t\tpr_debug(\"unknown flags %X\\n\", ahinfo-\u003einvflags);\n+\t\tpr_info_ratelimited(\"unknown flags %X\\n\", ahinfo-\u003einvflags);\n \t\treturn -EINVAL;\n \t}\n \treturn 0;\ndiff --git a/net/ipv6/netfilter/ip6t_frag.c b/net/ipv6/netfilter/ip6t_frag.c\nindex 3aad6439386b1..f5f3cfb8704cf 100644\n--- a/net/ipv6/netfilter/ip6t_frag.c\n+++ b/net/ipv6/netfilter/ip6t_frag.c\n@@ -23,12 +23,7 @@ MODULE_AUTHOR(\"Andras Kis-Szabo \u003ckisza@sch.bme.hu\u003e\");\n static inline bool\n id_match(u_int32_t min, u_int32_t max, u_int32_t id, bool invert)\n {\n-\tbool r;\n-\tpr_debug(\"id_match:%c 0x%x \u003c= 0x%x \u003c= 0x%x\\n\", invert ? '!' : ' ',\n-\t\t min, id, max);\n-\tr = (id \u003e= min \u0026\u0026 id \u003c= max) ^ invert;\n-\tpr_debug(\" result %s\\n\", r ? \"PASS\" : \"FAILED\");\n-\treturn r;\n+\treturn (id \u003e= min \u0026\u0026 id \u003c= max) ^ invert;\n }\n \n static bool\n@@ -53,38 +48,6 @@ frag_mt6(const struct sk_buff *skb, struct xt_action_param *par)\n \t\treturn false;\n \t}\n \n-\tpr_debug(\"INFO %04X \", fh-\u003efrag_off);\n-\tpr_debug(\"OFFSET %04X \", ntohs(fh-\u003efrag_off) \u0026 ~0x7);\n-\tpr_debug(\"RES %02X %04X\", fh-\u003ereserved, ntohs(fh-\u003efrag_off) \u0026 0x6);\n-\tpr_debug(\"MF %04X \", fh-\u003efrag_off \u0026 htons(IP6_MF));\n-\tpr_debug(\"ID %u %08X\\n\", ntohl(fh-\u003eidentification),\n-\t\t ntohl(fh-\u003eidentification));\n-\n-\tpr_debug(\"IPv6 FRAG id %02X \",\n-\t\t id_match(fraginfo-\u003eids[0], fraginfo-\u003eids[1],\n-\t\t\t  ntohl(fh-\u003eidentification),\n-\t\t\t  !!(fraginfo-\u003einvflags \u0026 IP6T_FRAG_INV_IDS)));\n-\tpr_debug(\"res %02X %02X%04X %02X \",\n-\t\t fraginfo-\u003eflags \u0026 IP6T_FRAG_RES, fh-\u003ereserved,\n-\t\t ntohs(fh-\u003efrag_off) \u0026 0x6,\n-\t\t !((fraginfo-\u003eflags \u0026 IP6T_FRAG_RES) \u0026\u0026\n-\t\t   (fh-\u003ereserved || (ntohs(fh-\u003efrag_off) \u0026 0x06))));\n-\tpr_debug(\"first %02X %02X %02X \",\n-\t\t fraginfo-\u003eflags \u0026 IP6T_FRAG_FST,\n-\t\t ntohs(fh-\u003efrag_off) \u0026 ~0x7,\n-\t\t !((fraginfo-\u003eflags \u0026 IP6T_FRAG_FST) \u0026\u0026\n-\t\t   (ntohs(fh-\u003efrag_off) \u0026 ~0x7)));\n-\tpr_debug(\"mf %02X %02X %02X \",\n-\t\t fraginfo-\u003eflags \u0026 IP6T_FRAG_MF,\n-\t\t ntohs(fh-\u003efrag_off) \u0026 IP6_MF,\n-\t\t !((fraginfo-\u003eflags \u0026 IP6T_FRAG_MF) \u0026\u0026\n-\t\t   !((ntohs(fh-\u003efrag_off) \u0026 IP6_MF))));\n-\tpr_debug(\"last %02X %02X %02X\\n\",\n-\t\t fraginfo-\u003eflags \u0026 IP6T_FRAG_NMF,\n-\t\t ntohs(fh-\u003efrag_off) \u0026 IP6_MF,\n-\t\t !((fraginfo-\u003eflags \u0026 IP6T_FRAG_NMF) \u0026\u0026\n-\t\t   (ntohs(fh-\u003efrag_off) \u0026 IP6_MF)));\n-\n \treturn id_match(fraginfo-\u003eids[0], fraginfo-\u003eids[1],\n \t\t\t ntohl(fh-\u003eidentification),\n \t\t\t !!(fraginfo-\u003einvflags \u0026 IP6T_FRAG_INV_IDS)) \u0026\u0026\n@@ -103,7 +66,7 @@ static int frag_mt6_check(const struct xt_mtchk_param *par)\n \tconst struct ip6t_frag *fraginfo = par-\u003ematchinfo;\n \n \tif (fraginfo-\u003einvflags \u0026 ~IP6T_FRAG_INV_MASK) {\n-\t\tpr_debug(\"unknown flags %X\\n\", fraginfo-\u003einvflags);\n+\t\tpr_info_ratelimited(\"unknown flags %X\\n\", fraginfo-\u003einvflags);\n \t\treturn -EINVAL;\n \t}\n \treturn 0;\ndiff --git a/net/ipv6/netfilter/ip6t_hbh.c b/net/ipv6/netfilter/ip6t_hbh.c\nindex 6d1a5d2026a67..37c207d3152a4 100644\n--- a/net/ipv6/netfilter/ip6t_hbh.c\n+++ b/net/ipv6/netfilter/ip6t_hbh.c\n@@ -79,14 +79,6 @@ hbh_mt6(const struct sk_buff *skb, struct xt_action_param *par)\n \t\treturn false;\n \t}\n \n-\tpr_debug(\"IPv6 OPTS LEN %u %u \", hdrlen, oh-\u003ehdrlen);\n-\n-\tpr_debug(\"len %02X %04X %02X \",\n-\t\t optinfo-\u003ehdrlen, hdrlen,\n-\t\t (!(optinfo-\u003eflags \u0026 IP6T_OPTS_LEN) ||\n-\t\t  ((optinfo-\u003ehdrlen == hdrlen) ^\n-\t\t   !!(optinfo-\u003einvflags \u0026 IP6T_OPTS_INV_LEN))));\n-\n \tret = (!(optinfo-\u003eflags \u0026 IP6T_OPTS_LEN) ||\n \t       ((optinfo-\u003ehdrlen == hdrlen) ^\n \t\t!!(optinfo-\u003einvflags \u0026 IP6T_OPTS_INV_LEN)));\n@@ -96,8 +88,6 @@ hbh_mt6(const struct sk_buff *skb, struct xt_action_param *par)\n \tif (!(optinfo-\u003eflags \u0026 IP6T_OPTS_OPTS)) {\n \t\treturn ret;\n \t} else {\n-\t\tpr_debug(\"Strict \");\n-\t\tpr_debug(\"#%d \", optinfo-\u003eoptsnr);\n \t\tfor (temp = 0; temp \u003c optinfo-\u003eoptsnr; temp++) {\n \t\t\t/* type field exists ? */\n \t\t\tif (hdrlen \u003c 1)\n@@ -108,13 +98,9 @@ hbh_mt6(const struct sk_buff *skb, struct xt_action_param *par)\n \t\t\t\tbreak;\n \n \t\t\t/* Type check */\n-\t\t\tif (*tp != (optinfo-\u003eopts[temp] \u0026 0xFF00) \u003e\u003e 8) {\n-\t\t\t\tpr_debug(\"Tbad %02X %02X\\n\", *tp,\n-\t\t\t\t\t (optinfo-\u003eopts[temp] \u0026 0xFF00) \u003e\u003e 8);\n+\t\t\tif (*tp != (optinfo-\u003eopts[temp] \u0026 0xFF00) \u003e\u003e 8)\n \t\t\t\treturn false;\n-\t\t\t} else {\n-\t\t\t\tpr_debug(\"Tok \");\n-\t\t\t}\n+\n \t\t\t/* Length check */\n \t\t\tif (*tp) {\n \t\t\t\tu16 spec_len;\n@@ -129,26 +115,18 @@ hbh_mt6(const struct sk_buff *skb, struct xt_action_param *par)\n \t\t\t\t\tbreak;\n \t\t\t\tspec_len = optinfo-\u003eopts[temp] \u0026 0x00FF;\n \n-\t\t\t\tif (spec_len != 0x00FF \u0026\u0026 spec_len != *lp) {\n-\t\t\t\t\tpr_debug(\"Lbad %02X %04X\\n\", *lp,\n-\t\t\t\t\t\t spec_len);\n+\t\t\t\tif (spec_len != 0x00FF \u0026\u0026 spec_len != *lp)\n \t\t\t\t\treturn false;\n-\t\t\t\t}\n-\t\t\t\tpr_debug(\"Lok \");\n+\n \t\t\t\toptlen = *lp + 2;\n \t\t\t} else {\n-\t\t\t\tpr_debug(\"Pad1\\n\");\n \t\t\t\toptlen = 1;\n \t\t\t}\n \n-\t\t\t/* Step to the next */\n-\t\t\tpr_debug(\"len%04X\\n\", optlen);\n-\n \t\t\tif ((ptr \u003e skb-\u003elen - optlen || hdrlen \u003c optlen) \u0026\u0026\n-\t\t\t    temp \u003c optinfo-\u003eoptsnr - 1) {\n-\t\t\t\tpr_debug(\"new pointer is too large!\\n\");\n+\t\t\t    temp \u003c optinfo-\u003eoptsnr - 1)\n \t\t\t\tbreak;\n-\t\t\t}\n+\n \t\t\tptr += optlen;\n \t\t\thdrlen -= optlen;\n \t\t}\n@@ -166,16 +144,16 @@ static int hbh_mt6_check(const struct xt_mtchk_param *par)\n \tconst struct ip6t_opts *optsinfo = par-\u003ematchinfo;\n \n \tif (optsinfo-\u003einvflags \u0026 ~IP6T_OPTS_INV_MASK) {\n-\t\tpr_debug(\"unknown flags %X\\n\", optsinfo-\u003einvflags);\n+\t\tpr_info_ratelimited(\"unknown flags %X\\n\", optsinfo-\u003einvflags);\n \t\treturn -EINVAL;\n \t}\n \tif (optsinfo-\u003eoptsnr \u003e IP6T_OPTS_OPTSNR) {\n-\t\tpr_debug(\"too many supported opts specified\\n\");\n+\t\tpr_info_ratelimited(\"too many supported opts specified\\n\");\n \t\treturn -EINVAL;\n \t}\n \n \tif (optsinfo-\u003eflags \u0026 IP6T_OPTS_NSTRICT) {\n-\t\tpr_debug(\"Not strict - not implemented\");\n+\t\tpr_info_ratelimited(\"Not strict - not implemented\");\n \t\treturn -EINVAL;\n \t}\n \ndiff --git a/net/ipv6/netfilter/ip6t_mh.c b/net/ipv6/netfilter/ip6t_mh.c\nindex fd492b69acbc0..ba6dcc7791a09 100644\n--- a/net/ipv6/netfilter/ip6t_mh.c\n+++ b/net/ipv6/netfilter/ip6t_mh.c\n@@ -42,14 +42,11 @@ static bool mh_mt6(const struct sk_buff *skb, struct xt_action_param *par)\n \tif (mh == NULL) {\n \t\t/* We've been asked to examine this packet, and we\n \t\t   can't.  Hence, no choice but to drop. */\n-\t\tpr_debug(\"Dropping evil MH tinygram.\\n\");\n \t\tpar-\u003ehotdrop = true;\n \t\treturn false;\n \t}\n \n \tif (mh-\u003eip6mh_proto != IPPROTO_NONE) {\n-\t\tpr_debug(\"Dropping invalid MH Payload Proto: %u\\n\",\n-\t\t\t mh-\u003eip6mh_proto);\n \t\tpar-\u003ehotdrop = true;\n \t\treturn false;\n \t}\ndiff --git a/net/ipv6/netfilter/ip6t_rpfilter.c b/net/ipv6/netfilter/ip6t_rpfilter.c\nindex 67c87a88cde4f..af8d10d49de81 100644\n--- a/net/ipv6/netfilter/ip6t_rpfilter.c\n+++ b/net/ipv6/netfilter/ip6t_rpfilter.c\n@@ -118,7 +118,7 @@ static int rpfilter_check(const struct xt_mtchk_param *par)\n \n \tif (strcmp(par-\u003etable, \"mangle\") != 0 \u0026\u0026\n \t    strcmp(par-\u003etable, \"raw\") != 0) {\n-\t\tpr_info_ratelimited(\"only valid in \\'raw\\' or \\'mangle\\' table, not \\'%s\\'\\n\",\n+\t\tpr_info_ratelimited(\"only valid in \\'raw\\' or \\'mangle\\' table\\n\",\n \t\t\t\t    par-\u003etable);\n \t\treturn -EINVAL;\n \t}\ndiff --git a/net/ipv6/netfilter/ip6t_rt.c b/net/ipv6/netfilter/ip6t_rt.c\nindex 278b52752f364..0c01ac2746d1f 100644\n--- a/net/ipv6/netfilter/ip6t_rt.c\n+++ b/net/ipv6/netfilter/ip6t_rt.c\n@@ -155,18 +155,18 @@ static int rt_mt6_check(const struct xt_mtchk_param *par)\n \tconst struct ip6t_rt *rtinfo = par-\u003ematchinfo;\n \n \tif (rtinfo-\u003einvflags \u0026 ~IP6T_RT_INV_MASK) {\n-\t\tpr_debug(\"unknown flags %X\\n\", rtinfo-\u003einvflags);\n+\t\tpr_info_ratelimited(\"unknown flags %X\\n\", rtinfo-\u003einvflags);\n \t\treturn -EINVAL;\n \t}\n \tif (rtinfo-\u003eaddrnr \u003e IP6T_RT_HOPS) {\n-\t\tpr_debug(\"too many addresses specified\\n\");\n+\t\tpr_info_ratelimited(\"too many addresses specified\\n\");\n \t\treturn -EINVAL;\n \t}\n \tif ((rtinfo-\u003eflags \u0026 (IP6T_RT_RES | IP6T_RT_FST_MASK)) \u0026\u0026\n \t    (!(rtinfo-\u003eflags \u0026 IP6T_RT_TYP) ||\n \t     (rtinfo-\u003ert_type != 0) ||\n \t     (rtinfo-\u003einvflags \u0026 IP6T_RT_INV_TYP))) {\n-\t\tpr_debug(\"`--rt-type 0' required before `--rt-0-*'\");\n+\t\tpr_info_ratelimited(\"`--rt-type 0' required before `--rt-0-*'\");\n \t\treturn -EINVAL;\n \t}\n \ndiff --git a/net/netfilter/xt_CONNSECMARK.c b/net/netfilter/xt_CONNSECMARK.c\nindex 1494b3ee30e11..4e4436a9104b4 100644\n--- a/net/netfilter/xt_CONNSECMARK.c\n+++ b/net/netfilter/xt_CONNSECMARK.c\n@@ -87,8 +87,7 @@ static int connsecmark_tg_check(const struct xt_tgchk_param *par)\n \n \tif (strcmp(par-\u003etable, \"mangle\") != 0 \u0026\u0026\n \t    strcmp(par-\u003etable, \"security\") != 0) {\n-\t\tpr_info_ratelimited(\"only valid in \\'mangle\\' or \\'security\\' table, not \\'%s\\'\\n\",\n-\t\t\t\t    par-\u003etable);\n+\t\tpr_info_ratelimited(\"only valid in \\'mangle\\' or \\'security\\' table\\n\");\n \t\treturn -EINVAL;\n \t}\n \ndiff --git a/net/netfilter/xt_CT.c b/net/netfilter/xt_CT.c\nindex e78660dfdf4b6..91326014ade1c 100644\n--- a/net/netfilter/xt_CT.c\n+++ b/net/netfilter/xt_CT.c\n@@ -195,7 +195,8 @@ static int xt_ct_tg_check(const struct xt_tgchk_param *par,\n \t\tgoto err3;\n \t}\n \n-\tif (info-\u003ehelper[0]) {\n+\tif (info-\u003ehelper[0] \u0026\u0026\n+\t    strnlen(info-\u003ehelper, sizeof(info-\u003ehelper)) \u003c sizeof(info-\u003ehelper)) {\n \t\tif (strnlen(info-\u003ehelper, sizeof(info-\u003ehelper)) == sizeof(info-\u003ehelper)) {\n \t\t\tret = -ENAMETOOLONG;\n \t\t\tgoto err3;\n@@ -206,7 +207,8 @@ static int xt_ct_tg_check(const struct xt_tgchk_param *par,\n \t\t\tgoto err3;\n \t}\n \n-\tif (info-\u003etimeout[0]) {\n+\tif (info-\u003etimeout[0] \u0026\u0026\n+\t    strnlen(info-\u003etimeout, sizeof(info-\u003etimeout)) \u003c sizeof(info-\u003etimeout)) {\n \t\tif (strnlen(info-\u003etimeout, sizeof(info-\u003etimeout)) == sizeof(info-\u003etimeout)) {\n \t\t\tret = -ENAMETOOLONG;\n \t\t\tgoto err4;\ndiff --git a/net/netfilter/xt_IDLETIMER.c b/net/netfilter/xt_IDLETIMER.c\nindex bfcf2d44e93db..15b698ea98aa6 100644\n--- a/net/netfilter/xt_IDLETIMER.c\n+++ b/net/netfilter/xt_IDLETIMER.c\n@@ -102,8 +102,6 @@ static void idletimer_tg_expired(struct timer_list *t)\n {\n \tstruct idletimer_tg *timer = timer_container_of(timer, t, timer);\n \n-\tpr_debug(\"timer %s expired\\n\", timer-\u003eattr.attr.name);\n-\n \tschedule_work(\u0026timer-\u003ework);\n }\n \n@@ -111,7 +109,6 @@ static void idletimer_tg_alarmproc(struct alarm *alarm, ktime_t now)\n {\n \tstruct idletimer_tg *timer = alarm-\u003edata;\n \n-\tpr_debug(\"alarm %s expired\\n\", timer-\u003eattr.attr.name);\n \tschedule_work(\u0026timer-\u003ework);\n }\n \n@@ -171,7 +168,7 @@ static int idletimer_tg_create(struct idletimer_tg_info *info)\n \n \tret = sysfs_create_file(idletimer_tg_kobj, \u0026info-\u003etimer-\u003eattr.attr);\n \tif (ret \u003c 0) {\n-\t\tpr_debug(\"couldn't add file to sysfs\");\n+\t\tpr_info_ratelimited(\"couldn't add file to sysfs\");\n \t\tgoto out_free_attr;\n \t}\n \n@@ -220,7 +217,7 @@ static int idletimer_tg_create_v1(struct idletimer_tg_info_v1 *info)\n \n \tret = sysfs_create_file(idletimer_tg_kobj, \u0026info-\u003etimer-\u003eattr.attr);\n \tif (ret \u003c 0) {\n-\t\tpr_debug(\"couldn't add file to sysfs\");\n+\t\tpr_info_ratelimited(\"couldn't add file to sysfs\");\n \t\tgoto out_free_attr;\n \t}\n \n@@ -228,7 +225,6 @@ static int idletimer_tg_create_v1(struct idletimer_tg_info_v1 *info)\n \tkobject_uevent(idletimer_tg_kobj,KOBJ_ADD);\n \n \tlist_add(\u0026info-\u003etimer-\u003eentry, \u0026idletimer_tg_list);\n-\tpr_debug(\"timer type value is %u\", info-\u003etimer_type);\n \tinfo-\u003etimer-\u003etimer_type = info-\u003etimer_type;\n \tinfo-\u003etimer-\u003erefcnt = 1;\n \n@@ -263,9 +259,6 @@ static unsigned int idletimer_tg_target(struct sk_buff *skb,\n {\n \tconst struct idletimer_tg_info *info = par-\u003etarginfo;\n \n-\tpr_debug(\"resetting timer %s, timeout period %u\\n\",\n-\t\t info-\u003elabel, info-\u003etimeout);\n-\n \tmod_timer(\u0026info-\u003etimer-\u003etimer,\n \t\t  secs_to_jiffies(info-\u003etimeout) + jiffies);\n \n@@ -280,9 +273,6 @@ static unsigned int idletimer_tg_target_v1(struct sk_buff *skb,\n {\n \tconst struct idletimer_tg_info_v1 *info = par-\u003etarginfo;\n \n-\tpr_debug(\"resetting timer %s, timeout period %u\\n\",\n-\t\t info-\u003elabel, info-\u003etimeout);\n-\n \tif (info-\u003etimer-\u003etimer_type \u0026 XT_IDLETIMER_ALARM) {\n \t\tidletimer_start_alarm_sec(info-\u003etimer, info-\u003etimeout);\n \t} else {\n@@ -296,17 +286,17 @@ static unsigned int idletimer_tg_target_v1(struct sk_buff *skb,\n static int idletimer_tg_helper(struct idletimer_tg_info *info)\n {\n \tif (info-\u003etimeout == 0) {\n-\t\tpr_debug(\"timeout value is zero\\n\");\n+\t\tpr_info_ratelimited(\"timeout value is zero\\n\");\n \t\treturn -EINVAL;\n \t}\n \tif (info-\u003etimeout \u003e= INT_MAX / 1000) {\n-\t\tpr_debug(\"timeout value is too big\\n\");\n+\t\tpr_info_ratelimited(\"timeout value is too big\\n\");\n \t\treturn -EINVAL;\n \t}\n \tif (info-\u003elabel[0] == '\\0' ||\n \t    strnlen(info-\u003elabel,\n \t\t    MAX_IDLETIMER_LABEL_SIZE) == MAX_IDLETIMER_LABEL_SIZE) {\n-\t\tpr_debug(\"label is empty or not nul-terminated\\n\");\n+\t\tpr_info_ratelimited(\"label is empty or not nul-terminated\\n\");\n \t\treturn -EINVAL;\n \t}\n \treturn 0;\n@@ -318,34 +308,25 @@ static int idletimer_tg_checkentry(const struct xt_tgchk_param *par)\n \tstruct idletimer_tg_info *info = par-\u003etarginfo;\n \tint ret;\n \n-\tpr_debug(\"checkentry targinfo%s\\n\", info-\u003elabel);\n-\n \tret = idletimer_tg_helper(info);\n \tif(ret \u003c 0)\n-\t{\n-\t\tpr_debug(\"checkentry helper return invalid\\n\");\n \t\treturn -EINVAL;\n-\t}\n \tmutex_lock(\u0026list_mutex);\n \n \tinfo-\u003etimer = __idletimer_tg_find_by_label(info-\u003elabel);\n \tif (info-\u003etimer) {\n \t\tif (info-\u003etimer-\u003etimer_type \u0026 XT_IDLETIMER_ALARM) {\n-\t\t\tpr_debug(\"Adding/Replacing rule with same label and different timer type is not allowed\\n\");\n \t\t\tmutex_unlock(\u0026list_mutex);\n+\t\t\tpr_info_ratelimited(\"Adding/Replacing rule with same label and different timer type is not allowed\\n\");\n \t\t\treturn -EINVAL;\n \t\t}\n \n \t\tinfo-\u003etimer-\u003erefcnt++;\n \t\tmod_timer(\u0026info-\u003etimer-\u003etimer,\n \t\t\t  secs_to_jiffies(info-\u003etimeout) + jiffies);\n-\n-\t\tpr_debug(\"increased refcnt of timer %s to %u\\n\",\n-\t\t\t info-\u003elabel, info-\u003etimer-\u003erefcnt);\n \t} else {\n \t\tret = idletimer_tg_create(info);\n \t\tif (ret \u003c 0) {\n-\t\t\tpr_debug(\"failed to create timer\\n\");\n \t\t\tmutex_unlock(\u0026list_mutex);\n \t\t\treturn ret;\n \t\t}\n@@ -360,30 +341,23 @@ static int idletimer_tg_checkentry_v1(const struct xt_tgchk_param *par)\n \tstruct idletimer_tg_info_v1 *info = par-\u003etarginfo;\n \tint ret;\n \n-\tpr_debug(\"checkentry targinfo%s\\n\", info-\u003elabel);\n-\n \tif (info-\u003esend_nl_msg)\n \t\treturn -EOPNOTSUPP;\n \n \tret = idletimer_tg_helper((struct idletimer_tg_info *)info);\n \tif(ret \u003c 0)\n-\t{\n-\t\tpr_debug(\"checkentry helper return invalid\\n\");\n \t\treturn -EINVAL;\n-\t}\n \n-\tif (info-\u003etimer_type \u003e XT_IDLETIMER_ALARM) {\n-\t\tpr_debug(\"invalid value for timer type\\n\");\n+\tif (info-\u003etimer_type \u003e XT_IDLETIMER_ALARM)\n \t\treturn -EINVAL;\n-\t}\n \n \tmutex_lock(\u0026list_mutex);\n \n \tinfo-\u003etimer = __idletimer_tg_find_by_label(info-\u003elabel);\n \tif (info-\u003etimer) {\n \t\tif (info-\u003etimer-\u003etimer_type != info-\u003etimer_type) {\n-\t\t\tpr_debug(\"Adding/Replacing rule with same label and different timer type is not allowed\\n\");\n \t\t\tmutex_unlock(\u0026list_mutex);\n+\t\t\tpr_info_ratelimited(\"Adding/Replacing rule with same label and different timer type is not allowed\\n\");\n \t\t\treturn -EINVAL;\n \t\t}\n \n@@ -393,21 +367,15 @@ static int idletimer_tg_checkentry_v1(const struct xt_tgchk_param *par)\n \t\t\tktime_t tout = alarm_expires_remaining(\u0026info-\u003etimer-\u003ealarm);\n \t\t\tstruct timespec64 ktimespec = ktime_to_timespec64(tout);\n \n-\t\t\tif (ktimespec.tv_sec \u003e 0) {\n-\t\t\t\tpr_debug(\"time_expiry_remaining %lld\\n\",\n-\t\t\t\t\t ktimespec.tv_sec);\n+\t\t\tif (ktimespec.tv_sec \u003e 0)\n \t\t\t\tidletimer_start_alarm_ktime(info-\u003etimer, tout);\n-\t\t\t}\n \t\t} else {\n \t\t\t\tmod_timer(\u0026info-\u003etimer-\u003etimer,\n \t\t\t\t\tsecs_to_jiffies(info-\u003etimeout) + jiffies);\n \t\t}\n-\t\tpr_debug(\"increased refcnt of timer %s to %u\\n\",\n-\t\t\t info-\u003elabel, info-\u003etimer-\u003erefcnt);\n \t} else {\n \t\tret = idletimer_tg_create_v1(info);\n \t\tif (ret \u003c 0) {\n-\t\t\tpr_debug(\"failed to create timer\\n\");\n \t\t\tmutex_unlock(\u0026list_mutex);\n \t\t\treturn ret;\n \t\t}\n@@ -421,19 +389,13 @@ static void idletimer_tg_destroy(const struct xt_tgdtor_param *par)\n {\n \tconst struct idletimer_tg_info *info = par-\u003etarginfo;\n \n-\tpr_debug(\"destroy targinfo %s\\n\", info-\u003elabel);\n-\n \tmutex_lock(\u0026list_mutex);\n \n \tif (--info-\u003etimer-\u003erefcnt \u003e 0) {\n-\t\tpr_debug(\"decreased refcnt of timer %s to %u\\n\",\n-\t\t\t info-\u003elabel, info-\u003etimer-\u003erefcnt);\n \t\tmutex_unlock(\u0026list_mutex);\n \t\treturn;\n \t}\n \n-\tpr_debug(\"deleting timer %s\\n\", info-\u003elabel);\n-\n \tlist_del(\u0026info-\u003etimer-\u003eentry);\n \tmutex_unlock(\u0026list_mutex);\n \n@@ -448,19 +410,13 @@ static void idletimer_tg_destroy_v1(const struct xt_tgdtor_param *par)\n {\n \tconst struct idletimer_tg_info_v1 *info = par-\u003etarginfo;\n \n-\tpr_debug(\"destroy targinfo %s\\n\", info-\u003elabel);\n-\n \tmutex_lock(\u0026list_mutex);\n \n \tif (--info-\u003etimer-\u003erefcnt \u003e 0) {\n-\t\tpr_debug(\"decreased refcnt of timer %s to %u\\n\",\n-\t\t\t info-\u003elabel, info-\u003etimer-\u003erefcnt);\n \t\tmutex_unlock(\u0026list_mutex);\n \t\treturn;\n \t}\n \n-\tpr_debug(\"deleting timer %s\\n\", info-\u003elabel);\n-\n \tlist_del(\u0026info-\u003etimer-\u003eentry);\n \tmutex_unlock(\u0026list_mutex);\n \n@@ -534,7 +490,7 @@ static int __init idletimer_tg_init(void)\n \tidletimer_tg_class = class_create(\"xt_idletimer\");\n \terr = PTR_ERR(idletimer_tg_class);\n \tif (IS_ERR(idletimer_tg_class)) {\n-\t\tpr_debug(\"couldn't register device class\\n\");\n+\t\tpr_info_ratelimited(\"couldn't register device class\\n\");\n \t\tgoto out;\n \t}\n \n@@ -542,7 +498,7 @@ static int __init idletimer_tg_init(void)\n \t\t\t\t\t    MKDEV(0, 0), NULL, \"timers\");\n \terr = PTR_ERR(idletimer_tg_device);\n \tif (IS_ERR(idletimer_tg_device)) {\n-\t\tpr_debug(\"couldn't register system device\\n\");\n+\t\tpr_info_ratelimited(\"couldn't register system device\\n\");\n \t\tgoto out_class;\n \t}\n \n@@ -551,7 +507,7 @@ static int __init idletimer_tg_init(void)\n \terr = xt_register_targets(idletimer_tg, ARRAY_SIZE(idletimer_tg));\n \n \tif (err \u003c 0) {\n-\t\tpr_debug(\"couldn't register xt target\\n\");\n+\t\tpr_info_ratelimited(\"couldn't register xt target\\n\");\n \t\tgoto out_dev;\n \t}\n \ndiff --git a/net/netfilter/xt_LOG.c b/net/netfilter/xt_LOG.c\nindex f39244f9c0ed9..de3f176792a07 100644\n--- a/net/netfilter/xt_LOG.c\n+++ b/net/netfilter/xt_LOG.c\n@@ -50,12 +50,12 @@ static int log_tg_check(const struct xt_tgchk_param *par)\n \t\treturn -EINVAL;\n \n \tif (loginfo-\u003elevel \u003e= 8) {\n-\t\tpr_debug(\"level %u \u003e= 8\\n\", loginfo-\u003elevel);\n+\t\tpr_info_ratelimited(\"level %u \u003e= 8\\n\", loginfo-\u003elevel);\n \t\treturn -EINVAL;\n \t}\n \n \tif (loginfo-\u003eprefix[sizeof(loginfo-\u003eprefix)-1] != '\\0') {\n-\t\tpr_debug(\"prefix is not null-terminated\\n\");\n+\t\tpr_info_ratelimited(\"prefix is not null-terminated\\n\");\n \t\treturn -EINVAL;\n \t}\n \ndiff --git a/net/netfilter/xt_MASQUERADE.c b/net/netfilter/xt_MASQUERADE.c\nindex eae05c1783367..cea488cec5445 100644\n--- a/net/netfilter/xt_MASQUERADE.c\n+++ b/net/netfilter/xt_MASQUERADE.c\n@@ -21,11 +21,11 @@ static int masquerade_tg_check(const struct xt_tgchk_param *par)\n \tconst struct nf_nat_ipv4_multi_range_compat *mr = par-\u003etarginfo;\n \n \tif (mr-\u003erange[0].flags \u0026 NF_NAT_RANGE_MAP_IPS) {\n-\t\tpr_debug(\"bad MAP_IPS.\\n\");\n+\t\tpr_info_ratelimited(\"bad MAP_IPS.\\n\");\n \t\treturn -EINVAL;\n \t}\n \tif (mr-\u003erangesize != 1) {\n-\t\tpr_debug(\"bad rangesize %u\\n\", mr-\u003erangesize);\n+\t\tpr_info_ratelimited(\"bad rangesize %u\\n\", mr-\u003erangesize);\n \t\treturn -EINVAL;\n \t}\n \treturn nf_ct_netns_get(par-\u003enet, par-\u003efamily);\ndiff --git a/net/netfilter/xt_NETMAP.c b/net/netfilter/xt_NETMAP.c\nindex cb2ee80d84fa8..8c86d9a43373a 100644\n--- a/net/netfilter/xt_NETMAP.c\n+++ b/net/netfilter/xt_NETMAP.c\n@@ -106,11 +106,11 @@ static int netmap_tg4_check(const struct xt_tgchk_param *par)\n \tconst struct nf_nat_ipv4_multi_range_compat *mr = par-\u003etarginfo;\n \n \tif (!(mr-\u003erange[0].flags \u0026 NF_NAT_RANGE_MAP_IPS)) {\n-\t\tpr_debug(\"bad MAP_IPS.\\n\");\n+\t\tpr_info_ratelimited(\"bad MAP_IPS.\\n\");\n \t\treturn -EINVAL;\n \t}\n \tif (mr-\u003erangesize != 1) {\n-\t\tpr_debug(\"bad rangesize %u.\\n\", mr-\u003erangesize);\n+\t\tpr_info_ratelimited(\"bad rangesize %u.\\n\", mr-\u003erangesize);\n \t\treturn -EINVAL;\n \t}\n \treturn nf_ct_netns_get(par-\u003enet, par-\u003efamily);\ndiff --git a/net/netfilter/xt_REDIRECT.c b/net/netfilter/xt_REDIRECT.c\nindex ff66b56a3f97d..27bc0545c4f74 100644\n--- a/net/netfilter/xt_REDIRECT.c\n+++ b/net/netfilter/xt_REDIRECT.c\n@@ -51,11 +51,11 @@ static int redirect_tg4_check(const struct xt_tgchk_param *par)\n \tconst struct nf_nat_ipv4_multi_range_compat *mr = par-\u003etarginfo;\n \n \tif (mr-\u003erange[0].flags \u0026 NF_NAT_RANGE_MAP_IPS) {\n-\t\tpr_debug(\"bad MAP_IPS.\\n\");\n+\t\tpr_info_ratelimited(\"bad MAP_IPS.\\n\");\n \t\treturn -EINVAL;\n \t}\n \tif (mr-\u003erangesize != 1) {\n-\t\tpr_debug(\"bad rangesize %u.\\n\", mr-\u003erangesize);\n+\t\tpr_info_ratelimited(\"bad rangesize %u.\\n\", mr-\u003erangesize);\n \t\treturn -EINVAL;\n \t}\n \treturn nf_ct_netns_get(par-\u003enet, par-\u003efamily);\ndiff --git a/net/netfilter/xt_SECMARK.c b/net/netfilter/xt_SECMARK.c\nindex 5bc5ea505eb9e..38e8e410b4e81 100644\n--- a/net/netfilter/xt_SECMARK.c\n+++ b/net/netfilter/xt_SECMARK.c\n@@ -79,8 +79,7 @@ secmark_tg_check(const char *table, struct xt_secmark_target_info_v1 *info)\n \n \tif (strcmp(table, \"mangle\") != 0 \u0026\u0026\n \t    strcmp(table, \"security\") != 0) {\n-\t\tpr_info_ratelimited(\"only valid in \\'mangle\\' or \\'security\\' table, not \\'%s\\'\\n\",\n-\t\t\t\t    table);\n+\t\tpr_info_ratelimited(\"only valid in \\'mangle\\' or \\'security\\' table\\n\");\n \t\treturn -EINVAL;\n \t}\n \ndiff --git a/net/netfilter/xt_cgroup.c b/net/netfilter/xt_cgroup.c\nindex 43d2ae2be628d..ac1b7e71cd7f5 100644\n--- a/net/netfilter/xt_cgroup.c\n+++ b/net/netfilter/xt_cgroup.c\n@@ -33,7 +33,7 @@ static int cgroup_mt_check_v0(const struct xt_mtchk_param *par)\n \t\treturn -EINVAL;\n \n \tif (!IS_ENABLED(CONFIG_CGROUP_NET_CLASSID)) {\n-\t\tpr_info(NET_CLS_CLASSID_INVALID_MSG);\n+\t\tpr_info_ratelimited(NET_CLS_CLASSID_INVALID_MSG);\n \t\treturn -EINVAL;\n \t}\n \n@@ -49,7 +49,7 @@ static int cgroup_mt_check_v1(const struct xt_mtchk_param *par)\n \t\treturn -EINVAL;\n \n \tif (!info-\u003ehas_path \u0026\u0026 !info-\u003ehas_classid) {\n-\t\tpr_info(\"xt_cgroup: no path or classid specified\\n\");\n+\t\tpr_info_ratelimited(\"xt_cgroup: no path or classid specified\\n\");\n \t\treturn -EINVAL;\n \t}\n \n@@ -59,7 +59,7 @@ static int cgroup_mt_check_v1(const struct xt_mtchk_param *par)\n \t}\n \n \tif (info-\u003ehas_classid \u0026\u0026 !IS_ENABLED(CONFIG_CGROUP_NET_CLASSID)) {\n-\t\tpr_info(NET_CLS_CLASSID_INVALID_MSG);\n+\t\tpr_info_ratelimited(NET_CLS_CLASSID_INVALID_MSG);\n \t\treturn -EINVAL;\n \t}\n \n@@ -89,7 +89,7 @@ static int cgroup_mt_check_v2(const struct xt_mtchk_param *par)\n \t\treturn -EINVAL;\n \n \tif (!info-\u003ehas_path \u0026\u0026 !info-\u003ehas_classid) {\n-\t\tpr_info(\"xt_cgroup: no path or classid specified\\n\");\n+\t\tpr_info_ratelimited(\"xt_cgroup: no path or classid specified\\n\");\n \t\treturn -EINVAL;\n \t}\n \n@@ -99,7 +99,7 @@ static int cgroup_mt_check_v2(const struct xt_mtchk_param *par)\n \t}\n \n \tif (info-\u003ehas_classid \u0026\u0026 !IS_ENABLED(CONFIG_CGROUP_NET_CLASSID)) {\n-\t\tpr_info(NET_CLS_CLASSID_INVALID_MSG);\n+\t\tpr_info_ratelimited(NET_CLS_CLASSID_INVALID_MSG);\n \t\treturn -EINVAL;\n \t}\n \ndiff --git a/net/netfilter/xt_esp.c b/net/netfilter/xt_esp.c\nindex 2a1c0ad0ff079..68fd75884268a 100644\n--- a/net/netfilter/xt_esp.c\n+++ b/net/netfilter/xt_esp.c\n@@ -25,12 +25,7 @@ MODULE_ALIAS(\"ip6t_esp\");\n static inline bool\n spi_match(u_int32_t min, u_int32_t max, u_int32_t spi, bool invert)\n {\n-\tbool r;\n-\tpr_debug(\"spi_match:%c 0x%x \u003c= 0x%x \u003c= 0x%x\\n\",\n-\t\t invert ? '!' : ' ', min, spi, max);\n-\tr = (spi \u003e= min \u0026\u0026 spi \u003c= max) ^ invert;\n-\tpr_debug(\" result %s\\n\", r ? \"PASS\" : \"FAILED\");\n-\treturn r;\n+\treturn (spi \u003e= min \u0026\u0026 spi \u003c= max) ^ invert;\n }\n \n static bool esp_mt(const struct sk_buff *skb, struct xt_action_param *par)\n@@ -48,7 +43,6 @@ static bool esp_mt(const struct sk_buff *skb, struct xt_action_param *par)\n \t\t/* We've been asked to examine this packet, and we\n \t\t * can't.  Hence, no choice but to drop.\n \t\t */\n-\t\tpr_debug(\"Dropping evil ESP tinygram.\\n\");\n \t\tpar-\u003ehotdrop = true;\n \t\treturn false;\n \t}\n@@ -62,7 +56,7 @@ static int esp_mt_check(const struct xt_mtchk_param *par)\n \tconst struct xt_esp *espinfo = par-\u003ematchinfo;\n \n \tif (espinfo-\u003einvflags \u0026 ~XT_ESP_INV_MASK) {\n-\t\tpr_debug(\"unknown flags %X\\n\", espinfo-\u003einvflags);\n+\t\tpr_info_ratelimited(\"unknown flags %X\\n\", espinfo-\u003einvflags);\n \t\treturn -EINVAL;\n \t}\n \ndiff --git a/net/netfilter/xt_ipcomp.c b/net/netfilter/xt_ipcomp.c\nindex 472da639a32e2..3299c1ea60f9e 100644\n--- a/net/netfilter/xt_ipcomp.c\n+++ b/net/netfilter/xt_ipcomp.c\n@@ -29,12 +29,7 @@ MODULE_ALIAS(\"ip6t_ipcomp\");\n static inline bool\n spi_match(u_int32_t min, u_int32_t max, u_int32_t spi, bool invert)\n {\n-\tbool r;\n-\tpr_debug(\"spi_match:%c 0x%x \u003c= 0x%x \u003c= 0x%x\\n\",\n-\t\t invert ? '!' : ' ', min, spi, max);\n-\tr = (spi \u003e= min \u0026\u0026 spi \u003c= max) ^ invert;\n-\tpr_debug(\" result %s\\n\", r ? \"PASS\" : \"FAILED\");\n-\treturn r;\n+\treturn (spi \u003e= min \u0026\u0026 spi \u003c= max) ^ invert;\n }\n \n static bool comp_mt(const struct sk_buff *skb, struct xt_action_param *par)\n@@ -52,7 +47,6 @@ static bool comp_mt(const struct sk_buff *skb, struct xt_action_param *par)\n \t\t/* We've been asked to examine this packet, and we\n \t\t * can't.  Hence, no choice but to drop.\n \t\t */\n-\t\tpr_debug(\"Dropping evil IPComp tinygram.\\n\");\n \t\tpar-\u003ehotdrop = true;\n \t\treturn false;\n \t}\ndiff --git a/net/netfilter/xt_iprange.c b/net/netfilter/xt_iprange.c\nindex 0c9e014e30b49..bf61141fb7850 100644\n--- a/net/netfilter/xt_iprange.c\n+++ b/net/netfilter/xt_iprange.c\n@@ -24,27 +24,15 @@ iprange_mt4(const struct sk_buff *skb, struct xt_action_param *par)\n \t\tm  = ntohl(iph-\u003esaddr) \u003c ntohl(info-\u003esrc_min.ip);\n \t\tm |= ntohl(iph-\u003esaddr) \u003e ntohl(info-\u003esrc_max.ip);\n \t\tm ^= !!(info-\u003eflags \u0026 IPRANGE_SRC_INV);\n-\t\tif (m) {\n-\t\t\tpr_debug(\"src IP %pI4 NOT in range %s%pI4-%pI4\\n\",\n-\t\t\t         \u0026iph-\u003esaddr,\n-\t\t\t         (info-\u003eflags \u0026 IPRANGE_SRC_INV) ? \"(INV) \" : \"\",\n-\t\t\t         \u0026info-\u003esrc_min.ip,\n-\t\t\t         \u0026info-\u003esrc_max.ip);\n+\t\tif (m)\n \t\t\treturn false;\n-\t\t}\n \t}\n \tif (info-\u003eflags \u0026 IPRANGE_DST) {\n \t\tm  = ntohl(iph-\u003edaddr) \u003c ntohl(info-\u003edst_min.ip);\n \t\tm |= ntohl(iph-\u003edaddr) \u003e ntohl(info-\u003edst_max.ip);\n \t\tm ^= !!(info-\u003eflags \u0026 IPRANGE_DST_INV);\n-\t\tif (m) {\n-\t\t\tpr_debug(\"dst IP %pI4 NOT in range %s%pI4-%pI4\\n\",\n-\t\t\t         \u0026iph-\u003edaddr,\n-\t\t\t         (info-\u003eflags \u0026 IPRANGE_DST_INV) ? \"(INV) \" : \"\",\n-\t\t\t         \u0026info-\u003edst_min.ip,\n-\t\t\t         \u0026info-\u003edst_max.ip);\n+\t\tif (m)\n \t\t\treturn false;\n-\t\t}\n \t}\n \treturn true;\n }\n@@ -73,27 +61,15 @@ iprange_mt6(const struct sk_buff *skb, struct xt_action_param *par)\n \t\tm  = iprange_ipv6_lt(\u0026iph-\u003esaddr, \u0026info-\u003esrc_min.in6);\n \t\tm |= iprange_ipv6_lt(\u0026info-\u003esrc_max.in6, \u0026iph-\u003esaddr);\n \t\tm ^= !!(info-\u003eflags \u0026 IPRANGE_SRC_INV);\n-\t\tif (m) {\n-\t\t\tpr_debug(\"src IP %pI6 NOT in range %s%pI6-%pI6\\n\",\n-\t\t\t\t \u0026iph-\u003esaddr,\n-\t\t\t\t (info-\u003eflags \u0026 IPRANGE_SRC_INV) ? \"(INV) \" : \"\",\n-\t\t\t\t \u0026info-\u003esrc_min.in6,\n-\t\t\t\t \u0026info-\u003esrc_max.in6);\n+\t\tif (m)\n \t\t\treturn false;\n-\t\t}\n \t}\n \tif (info-\u003eflags \u0026 IPRANGE_DST) {\n \t\tm  = iprange_ipv6_lt(\u0026iph-\u003edaddr, \u0026info-\u003edst_min.in6);\n \t\tm |= iprange_ipv6_lt(\u0026info-\u003edst_max.in6, \u0026iph-\u003edaddr);\n \t\tm ^= !!(info-\u003eflags \u0026 IPRANGE_DST_INV);\n-\t\tif (m) {\n-\t\t\tpr_debug(\"dst IP %pI6 NOT in range %s%pI6-%pI6\\n\",\n-\t\t\t\t \u0026iph-\u003edaddr,\n-\t\t\t\t (info-\u003eflags \u0026 IPRANGE_DST_INV) ? \"(INV) \" : \"\",\n-\t\t\t\t \u0026info-\u003edst_min.in6,\n-\t\t\t\t \u0026info-\u003edst_max.in6);\n+\t\tif (m)\n \t\t\treturn false;\n-\t\t}\n \t}\n \treturn true;\n }\ndiff --git a/net/netfilter/xt_ipvs.c b/net/netfilter/xt_ipvs.c\nindex 253c71cc9a634..e13c0ffb73a9a 100644\n--- a/net/netfilter/xt_ipvs.c\n+++ b/net/netfilter/xt_ipvs.c\n@@ -148,7 +148,6 @@ ipvs_mt(const struct sk_buff *skb, struct xt_action_param *par)\n out_put_cp:\n \t__ip_vs_conn_put(cp);\n out:\n-\tpr_debug(\"match=%d\\n\", match);\n \treturn match;\n }\n \ndiff --git a/net/netfilter/xt_multiport.c b/net/netfilter/xt_multiport.c\nindex a1691ff405d3c..bff5f53a9befb 100644\n--- a/net/netfilter/xt_multiport.c\n+++ b/net/netfilter/xt_multiport.c\n@@ -37,7 +37,6 @@ ports_match_v1(const struct xt_multiport_v1 *minfo,\n \t\tif (minfo-\u003epflags[i]) {\n \t\t\t/* range port matching */\n \t\t\te = minfo-\u003eports[++i];\n-\t\t\tpr_debug(\"src or dst matches with %d-%d?\\n\", s, e);\n \n \t\t\tswitch (minfo-\u003eflags) {\n \t\t\tcase XT_MULTIPORT_SOURCE:\n@@ -58,8 +57,6 @@ ports_match_v1(const struct xt_multiport_v1 *minfo,\n \t\t\t}\n \t\t} else {\n \t\t\t/* exact port matching */\n-\t\t\tpr_debug(\"src or dst matches with %d?\\n\", s);\n-\n \t\t\tswitch (minfo-\u003eflags) {\n \t\t\tcase XT_MULTIPORT_SOURCE:\n \t\t\t\tif (src == s)\n@@ -97,7 +94,6 @@ multiport_mt(const struct sk_buff *skb, struct xt_action_param *par)\n \t\t/* We've been asked to examine this packet, and we\n \t\t * can't.  Hence, no choice but to drop.\n \t\t */\n-\t\tpr_debug(\"Dropping evil offset=0 tinygram.\\n\");\n \t\tpar-\u003ehotdrop = true;\n \t\treturn false;\n \t}\ndiff --git a/net/netfilter/xt_sctp.c b/net/netfilter/xt_sctp.c\nindex b46a6a5120583..d35c21d9651b0 100644\n--- a/net/netfilter/xt_sctp.c\n+++ b/net/netfilter/xt_sctp.c\n@@ -48,30 +48,17 @@ match_packet(const struct sk_buff *skb,\n \tconst struct xt_sctp_flag_info *flag_info = info-\u003eflag_info;\n \tint flag_count = info-\u003eflag_count;\n \n-#ifdef DEBUG\n-\tint i = 0;\n-#endif\n-\n \tif (chunk_match_type == SCTP_CHUNK_MATCH_ALL)\n \t\tSCTP_CHUNKMAP_COPY(chunkmapcopy, info-\u003echunkmap);\n \n \tdo {\n \t\tsch = skb_header_pointer(skb, offset, sizeof(_sch), \u0026_sch);\n \t\tif (sch == NULL || sch-\u003elength == 0) {\n-\t\t\tpr_debug(\"Dropping invalid SCTP packet.\\n\");\n \t\t\t*hotdrop = true;\n \t\t\treturn false;\n \t\t}\n-#ifdef DEBUG\n-\t\tpr_debug(\"Chunk num: %d\\toffset: %d\\ttype: %d\\tlength: %d\"\n-\t\t\t \"\\tflags: %x\\n\",\n-\t\t\t ++i, offset, sch-\u003etype, htons(sch-\u003elength),\n-\t\t\t sch-\u003eflags);\n-#endif\n \t\toffset += SCTP_PAD4(ntohs(sch-\u003elength));\n \n-\t\tpr_debug(\"skb-\u003elen: %d\\toffset: %d\\n\", skb-\u003elen, offset);\n-\n \t\tif (SCTP_CHUNKMAP_IS_SET(info-\u003echunkmap, sch-\u003etype)) {\n \t\t\tswitch (chunk_match_type) {\n \t\t\tcase SCTP_CHUNK_MATCH_ANY:\n@@ -121,18 +108,14 @@ sctp_mt(const struct sk_buff *skb, struct xt_action_param *par)\n \tconst struct sctphdr *sh;\n \tstruct sctphdr _sh;\n \n-\tif (par-\u003efragoff != 0) {\n-\t\tpr_debug(\"Dropping non-first fragment.. FIXME\\n\");\n+\tif (par-\u003efragoff != 0)\n \t\treturn false;\n-\t}\n \n \tsh = skb_header_pointer(skb, par-\u003ethoff, sizeof(_sh), \u0026_sh);\n \tif (sh == NULL) {\n-\t\tpr_debug(\"Dropping evil TCP offset=0 tinygram.\\n\");\n \t\tpar-\u003ehotdrop = true;\n \t\treturn false;\n \t}\n-\tpr_debug(\"spt: %d\\tdpt: %d\\n\", ntohs(sh-\u003esource), ntohs(sh-\u003edest));\n \n \treturn  SCCHECK(ntohs(sh-\u003esource) \u003e= info-\u003espts[0]\n \t\t\t\u0026\u0026 ntohs(sh-\u003esource) \u003c= info-\u003espts[1],\ndiff --git a/net/netfilter/xt_tcpudp.c b/net/netfilter/xt_tcpudp.c\nindex f76cf18f1a244..70608b8d06ab2 100644\n--- a/net/netfilter/xt_tcpudp.c\n+++ b/net/netfilter/xt_tcpudp.c\n@@ -44,8 +44,6 @@ tcp_find_option(u_int8_t option,\n \tu_int8_t _opt[60 - sizeof(struct tcphdr)];\n \tunsigned int i;\n \n-\tpr_debug(\"finding option\\n\");\n-\n \tif (!optlen)\n \t\treturn invert;\n \n@@ -81,10 +79,8 @@ static bool tcp_mt(const struct sk_buff *skb, struct xt_action_param *par)\n \t\t   causes this. Its a cracker trying to break in by doing a\n \t\t   flag overwrite to pass the direction checks.\n \t\t*/\n-\t\tif (par-\u003efragoff == 1) {\n-\t\t\tpr_debug(\"Dropping evil TCP offset=1 frag.\\n\");\n+\t\tif (par-\u003efragoff == 1)\n \t\t\tpar-\u003ehotdrop = true;\n-\t\t}\n \t\t/* Must not be a fragment. */\n \t\treturn false;\n \t}\n@@ -93,7 +89,6 @@ static bool tcp_mt(const struct sk_buff *skb, struct xt_action_param *par)\n \tif (th == NULL) {\n \t\t/* We've been asked to examine this packet, and we\n \t\t   can't.  Hence, no choice but to drop. */\n-\t\tpr_debug(\"Dropping evil TCP offset=0 tinygram.\\n\");\n \t\tpar-\u003ehotdrop = true;\n \t\treturn false;\n \t}\n@@ -145,7 +140,6 @@ static bool udp_mt(const struct sk_buff *skb, struct xt_action_param *par)\n \tif (uh == NULL) {\n \t\t/* We've been asked to examine this packet, and we\n \t\t   can't.  Hence, no choice but to drop. */\n-\t\tpr_debug(\"Dropping evil UDP tinygram.\\n\");\n \t\tpar-\u003ehotdrop = true;\n \t\treturn false;\n \t}\n"
}

{
  "EnableConfigs": [
    "NETFILTER_XT_TARGET_CT",
    "NETFILTER_XT_TARGET_IDLETIMER",
    "NF_CONNTRACK",
    "IP_NF_RAW",
    "NETFILTER_ADVANCED"
  ],
  "FocusSymbols": [
    "xt_ct_tg_check",
    "idletimer_tg_checkentry",
    "idletimer_tg_checkentry_v1"
  ],
  "Reasoning": "The patch modifies `xt_CT.c` to change the validation logic for `info-\u003ehelper` and `info-\u003etimeout`. If they are not null-terminated, the new code skips setting them instead of returning `-ENAMETOOLONG`, which is a functional change in the target initialization logic. The patch also modifies `xt_IDLETIMER.c` to release a mutex before logging, which is a minor functional change. These changes alter the execution flow and are reachable from userspace via netfilter configuration.",
  "WorthFuzzing": true
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
  even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).
- Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed,
  ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU.
- Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove)
  that are executed only during PCI hot-unplug or sysfs driver unbind operations.

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
   Prefer non-static, non-inlined API entrypoint functions over internal static helper functions
   (which are inlined by the compiler and do not have distinct symbol addresses).
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs
   needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs
   output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit 9338aec55ce1ed0fef018b0c87a6ae341b6a6a77
Author: syz-cluster <triage@syzkaller.com>
Date:   Tue Aug 18 14:39:20 2026 +0000

    syz-cluster: applied patch under review

diff --git a/net/ipv4/netfilter/ipt_ah.c b/net/ipv4/netfilter/ipt_ah.c
index 161ba412cb08b..7131f297ada2e 100644
--- a/net/ipv4/netfilter/ipt_ah.c
+++ b/net/ipv4/netfilter/ipt_ah.c
@@ -19,12 +19,7 @@ MODULE_DESCRIPTION("Xtables: IPv4 IPsec-AH SPI match");
 static inline bool
 spi_match(u_int32_t min, u_int32_t max, u_int32_t spi, bool invert)
 {
-	bool r;
-	pr_debug("spi_match:%c 0x%x <= 0x%x <= 0x%x\n",
-		 invert ? '!' : ' ', min, spi, max);
-	r = (spi >= min && spi <= max) ^ invert;
-	pr_debug(" result %s\n", r ? "PASS" : "FAILED");
-	return r;
+	return (spi >= min && spi <= max) ^ invert;
 }
 
 static bool ah_mt(const struct sk_buff *skb, struct xt_action_param *par)
@@ -42,7 +37,6 @@ static bool ah_mt(const struct sk_buff *skb, struct xt_action_param *par)
 		/* We've been asked to examine this packet, and we
 		 * can't.  Hence, no choice but to drop.
 		 */
-		pr_debug("Dropping evil AH tinygram.\n");
 		par->hotdrop = true;
 		return false;
 	}
@@ -58,7 +52,7 @@ static int ah_mt_check(const struct xt_mtchk_param *par)
 
 	/* Must specify no unknown invflags */
 	if (ahinfo->invflags & ~IPT_AH_INV_MASK) {
-		pr_debug("unknown flags %X\n", ahinfo->invflags);
+		pr_info_ratelimited("unknown flags %X\n", ahinfo->invflags);
 		return -EINVAL;
 	}
 	return 0;
diff --git a/net/ipv4/netfilter/ipt_rpfilter.c b/net/ipv4/netfilter/ipt_rpfilter.c
index 6d9bf51068684..2c38fd6624aa1 100644
--- a/net/ipv4/netfilter/ipt_rpfilter.c
+++ b/net/ipv4/netfilter/ipt_rpfilter.c
@@ -95,8 +95,7 @@ static int rpfilter_check(const struct xt_mtchk_param *par)
 
 	if (strcmp(par->table, "mangle") != 0 &&
 	    strcmp(par->table, "raw") != 0) {
-		pr_info_ratelimited("only valid in \'raw\' or \'mangle\' table, not \'%s\'\n",
-				    par->table);
+		pr_info_ratelimited("only valid in \'raw\' or \'mangle\' table\n");
 		return -EINVAL;
 	}
 
diff --git a/net/ipv6/netfilter/ip6t_ah.c b/net/ipv6/netfilter/ip6t_ah.c
index 1258783ed8762..dab7dbc6a675c 100644
--- a/net/ipv6/netfilter/ip6t_ah.c
+++ b/net/ipv6/netfilter/ip6t_ah.c
@@ -24,13 +24,7 @@ MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>");
 static inline bool
 spi_match(u_int32_t min, u_int32_t max, u_int32_t spi, bool invert)
 {
-	bool r;
-
-	pr_debug("spi_match:%c 0x%x <= 0x%x <= 0x%x\n",
-		 invert ? '!' : ' ', min, spi, max);
-	r = (spi >= min && spi <= max) ^ invert;
-	pr_debug(" result %s\n", r ? "PASS" : "FAILED");
-	return r;
+	return (spi >= min && spi <= max) ^ invert;
 }
 
 static bool ah_mt6(const struct sk_buff *skb, struct xt_action_param *par)
@@ -62,23 +56,6 @@ static bool ah_mt6(const struct sk_buff *skb, struct xt_action_param *par)
 		return false;
 	}
 
-	pr_debug("IPv6 AH LEN %u %u ", hdrlen, ah->hdrlen);
-	pr_debug("RES %04X ", ah->reserved);
-	pr_debug("SPI %u %08X\n", ntohl(ah->spi), ntohl(ah->spi));
-
-	pr_debug("IPv6 AH spi %02X ",
-		 spi_match(ahinfo->spis[0], ahinfo->spis[1],
-			   ntohl(ah->spi),
-			   !!(ahinfo->invflags & IP6T_AH_INV_SPI)));
-	pr_debug("len %02X %04X %02X ",
-		 ahinfo->hdrlen, hdrlen,
-		 (!ahinfo->hdrlen ||
-		  (ahinfo->hdrlen == hdrlen) ^
-		  !!(ahinfo->invflags & IP6T_AH_INV_LEN)));
-	pr_debug("res %02X %04X %02X\n",
-		 ahinfo->hdrres, ah->reserved,
-		 !(ahinfo->hdrres && ah->reserved));
-
 	return spi_match(ahinfo->spis[0], ahinfo->spis[1],
 			  ntohl(ah->spi),
 			  !!(ahinfo->invflags & IP6T_AH_INV_SPI)) &&
@@ -93,7 +70,7 @@ static int ah_mt6_check(const struct xt_mtchk_param *par)
 	const struct ip6t_ah *ahinfo = par->matchinfo;
 
 	if (ahinfo->invflags & ~IP6T_AH_INV_MASK) {
-		pr_debug("unknown flags %X\n", ahinfo->invflags);
+		pr_info_ratelimited("unknown flags %X\n", ahinfo->invflags);
 		return -EINVAL;
 	}
 	return 0;
diff --git a/net/ipv6/netfilter/ip6t_frag.c b/net/ipv6/netfilter/ip6t_frag.c
index 3aad6439386b1..f5f3cfb8704cf 100644
--- a/net/ipv6/netfilter/ip6t_frag.c
+++ b/net/ipv6/netfilter/ip6t_frag.c
@@ -23,12 +23,7 @@ MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>");
 static inline bool
 id_match(u_int32_t min, u_int32_t max, u_int32_t id, bool invert)
 {
-	bool r;
-	pr_debug("id_match:%c 0x%x <= 0x%x <= 0x%x\n", invert ? '!' : ' ',
-		 min, id, max);
-	r = (id >= min && id <= max) ^ invert;
-	pr_debug(" result %s\n", r ? "PASS" : "FAILED");
-	return r;
+	return (id >= min && id <= max) ^ invert;
 }
 
 static bool
@@ -53,38 +48,6 @@ frag_mt6(const struct sk_buff *skb, struct xt_action_param *par)
 		return false;
 	}
 
-	pr_debug("INFO %04X ", fh->frag_off);
-	pr_debug("OFFSET %04X ", ntohs(fh->frag_off) & ~0x7);
-	pr_debug("RES %02X %04X", fh->reserved, ntohs(fh->frag_off) & 0x6);
-	pr_debug("MF %04X ", fh->frag_off & htons(IP6_MF));
-	pr_debug("ID %u %08X\n", ntohl(fh->identification),
-		 ntohl(fh->identification));
-
-	pr_debug("IPv6 FRAG id %02X ",
-		 id_match(fraginfo->ids[0], fraginfo->ids[1],
-			  ntohl(fh->identification),
-			  !!(fraginfo->invflags & IP6T_FRAG_INV_IDS)));
-	pr_debug("res %02X %02X%04X %02X ",
-		 fraginfo->flags & IP6T_FRAG_RES, fh->reserved,
-		 ntohs(fh->frag_off) & 0x6,
-		 !((fraginfo->flags & IP6T_FRAG_RES) &&
-		   (fh->reserved || (ntohs(fh->frag_off) & 0x06))));
-	pr_debug("first %02X %02X %02X ",
-		 fraginfo->flags & IP6T_FRAG_FST,
-		 ntohs(fh->frag_off) & ~0x7,
-		 !((fraginfo->flags & IP6T_FRAG_FST) &&
-		   (ntohs(fh->frag_off) & ~0x7)));
-	pr_debug("mf %02X %02X %02X ",
-		 fraginfo->flags & IP6T_FRAG_MF,
-		 ntohs(fh->frag_off) & IP6_MF,
-		 !((fraginfo->flags & IP6T_FRAG_MF) &&
-		   !((ntohs(fh->frag_off) & IP6_MF))));
-	pr_debug("last %02X %02X %02X\n",
-		 fraginfo->flags & IP6T_FRAG_NMF,
-		 ntohs(fh->frag_off) & IP6_MF,
-		 !((fraginfo->flags & IP6T_FRAG_NMF) &&
-		   (ntohs(fh->frag_off) & IP6_MF)));
-
 	return id_match(fraginfo->ids[0], fraginfo->ids[1],
 			 ntohl(fh->identification),
 			 !!(fraginfo->invflags & IP6T_FRAG_INV_IDS)) &&
@@ -103,7 +66,7 @@ static int frag_mt6_check(const struct xt_mtchk_param *par)
 	const struct ip6t_frag *fraginfo = par->matchinfo;
 
 	if (fraginfo->invflags & ~IP6T_FRAG_INV_MASK) {
-		pr_debug("unknown flags %X\n", fraginfo->invflags);
+		pr_info_ratelimited("unknown flags %X\n", fraginfo->invflags);
 		return -EINVAL;
 	}
 	return 0;
diff --git a/net/ipv6/netfilter/ip6t_hbh.c b/net/ipv6/netfilter/ip6t_hbh.c
index 6d1a5d2026a67..37c207d3152a4 100644
--- a/net/ipv6/netfilter/ip6t_hbh.c
+++ b/net/ipv6/netfilter/ip6t_hbh.c
@@ -79,14 +79,6 @@ hbh_mt6(const struct sk_buff *skb, struct xt_action_param *par)
 		return false;
 	}
 
-	pr_debug("IPv6 OPTS LEN %u %u ", hdrlen, oh->hdrlen);
-
-	pr_debug("len %02X %04X %02X ",
-		 optinfo->hdrlen, hdrlen,
-		 (!(optinfo->flags & IP6T_OPTS_LEN) ||
-		  ((optinfo->hdrlen == hdrlen) ^
-		   !!(optinfo->invflags & IP6T_OPTS_INV_LEN))));
-
 	ret = (!(optinfo->flags & IP6T_OPTS_LEN) ||
 	       ((optinfo->hdrlen == hdrlen) ^
 		!!(optinfo->invflags & IP6T_OPTS_INV_LEN)));
@@ -96,8 +88,6 @@ hbh_mt6(const struct sk_buff *skb, struct xt_action_param *par)
 	if (!(optinfo->flags & IP6T_OPTS_OPTS)) {
 		return ret;
 	} else {
-		pr_debug("Strict ");
-		pr_debug("#%d ", optinfo->optsnr);
 		for (temp = 0; temp < optinfo->optsnr; temp++) {
 			/* type field exists ? */
 			if (hdrlen < 1)
@@ -108,13 +98,9 @@ hbh_mt6(const struct sk_buff *skb, struct xt_action_param *par)
 				break;
 
 			/* Type check */
-			if (*tp != (optinfo->opts[temp] & 0xFF00) >> 8) {
-				pr_debug("Tbad %02X %02X\n", *tp,
-					 (optinfo->opts[temp] & 0xFF00) >> 8);
+			if (*tp != (optinfo->opts[temp] & 0xFF00) >> 8)
 				return false;
-			} else {
-				pr_debug("Tok ");
-			}
+
 			/* Length check */
 			if (*tp) {
 				u16 spec_len;
@@ -129,26 +115,18 @@ hbh_mt6(const struct sk_buff *skb, struct xt_action_param *par)
 					break;
 				spec_len = optinfo->opts[temp] & 0x00FF;
 
-				if (spec_len != 0x00FF && spec_len != *lp) {
-					pr_debug("Lbad %02X %04X\n", *lp,
-						 spec_len);
+				if (spec_len != 0x00FF && spec_len != *lp)
 					return false;
-				}
-				pr_debug("Lok ");
+
 				optlen = *lp + 2;
 			} else {
-				pr_debug("Pad1\n");
 				optlen = 1;
 			}
 
-			/* Step to the next */
-			pr_debug("len%04X\n", optlen);
-
 			if ((ptr > skb->len - optlen || hdrlen < optlen) &&
-			    temp < optinfo->optsnr - 1) {
-				pr_debug("new pointer is too large!\n");
+			    temp < optinfo->optsnr - 1)
 				break;
-			}
+
 			ptr += optlen;
 			hdrlen -= optlen;
 		}
@@ -166,16 +144,16 @@ static int hbh_mt6_check(const struct xt_mtchk_param *par)
 	const struct ip6t_opts *optsinfo = par->matchinfo;
 
 	if (optsinfo->invflags & ~IP6T_OPTS_INV_MASK) {
-		pr_debug("unknown flags %X\n", optsinfo->invflags);
+		pr_info_ratelimited("unknown flags %X\n", optsinfo->invflags);
 		return -EINVAL;
 	}
 	if (optsinfo->optsnr > IP6T_OPTS_OPTSNR) {
-		pr_debug("too many supported opts specified\n");
+		pr_info_ratelimited("too many supported opts specified\n");
 		return -EINVAL;
 	}
 
 	if (optsinfo->flags & IP6T_OPTS_NSTRICT) {
-		pr_debug("Not strict - not implemented");
+		pr_info_ratelimited("Not strict - not implemented");
 		return -EINVAL;
 	}
 
diff --git a/net/ipv6/netfilter/ip6t_mh.c b/net/ipv6/netfilter/ip6t_mh.c
index fd492b69acbc0..ba6dcc7791a09 100644
--- a/net/ipv6/netfilter/ip6t_mh.c
+++ b/net/ipv6/netfilter/ip6t_mh.c
@@ -42,14 +42,11 @@ static bool mh_mt6(const struct sk_buff *skb, struct xt_action_param *par)
 	if (mh == NULL) {
 		/* We've been asked to examine this packet, and we
 		   can't.  Hence, no choice but to drop. */
-		pr_debug("Dropping evil MH tinygram.\n");
 		par->hotdrop = true;
 		return false;
 	}
 
 	if (mh->ip6mh_proto != IPPROTO_NONE) {
-		pr_debug("Dropping invalid MH Payload Proto: %u\n",
-			 mh->ip6mh_proto);
 		par->hotdrop = true;
 		return false;
 	}
diff --git a/net/ipv6/netfilter/ip6t_rpfilter.c b/net/ipv6/netfilter/ip6t_rpfilter.c
index 67c87a88cde4f..af8d10d49de81 100644
--- a/net/ipv6/netfilter/ip6t_rpfilter.c
+++ b/net/ipv6/netfilter/ip6t_rpfilter.c
@@ -118,7 +118,7 @@ static int rpfilter_check(const struct xt_mtchk_param *par)
 
 	if (strcmp(par->table, "mangle") != 0 &&
 	    strcmp(par->table, "raw") != 0) {
-		pr_info_ratelimited("only valid in \'raw\' or \'mangle\' table, not \'%s\'\n",
+		pr_info_ratelimited("only valid in \'raw\' or \'mangle\' table\n",
 				    par->table);
 		return -EINVAL;
 	}
diff --git a/net/ipv6/netfilter/ip6t_rt.c b/net/ipv6/netfilter/ip6t_rt.c
index 278b52752f364..0c01ac2746d1f 100644
--- a/net/ipv6/netfilter/ip6t_rt.c
+++ b/net/ipv6/netfilter/ip6t_rt.c
@@ -155,18 +155,18 @@ static int rt_mt6_check(const struct xt_mtchk_param *par)
 	const struct ip6t_rt *rtinfo = par->matchinfo;
 
 	if (rtinfo->invflags & ~IP6T_RT_INV_MASK) {
-		pr_debug("unknown flags %X\n", rtinfo->invflags);
+		pr_info_ratelimited("unknown flags %X\n", rtinfo->invflags);
 		return -EINVAL;
 	}
 	if (rtinfo->addrnr > IP6T_RT_HOPS) {
-		pr_debug("too many addresses specified\n");
+		pr_info_ratelimited("too many addresses specified\n");
 		return -EINVAL;
 	}
 	if ((rtinfo->flags & (IP6T_RT_RES | IP6T_RT_FST_MASK)) &&
 	    (!(rtinfo->flags & IP6T_RT_TYP) ||
 	     (rtinfo->rt_type != 0) ||
 	     (rtinfo->invflags & IP6T_RT_INV_TYP))) {
-		pr_debug("`--rt-type 0' required before `--rt-0-*'");
+		pr_info_ratelimited("`--rt-type 0' required before `--rt-0-*'");
 		return -EINVAL;
 	}
 
diff --git a/net/netfilter/xt_CONNSECMARK.c b/net/netfilter/xt_CONNSECMARK.c
index 1494b3ee30e11..4e4436a9104b4 100644
--- a/net/netfilter/xt_CONNSECMARK.c
+++ b/net/netfilter/xt_CONNSECMARK.c
@@ -87,8 +87,7 @@ static int connsecmark_tg_check(const struct xt_tgchk_param *par)
 
 	if (strcmp(par->table, "mangle") != 0 &&
 	    strcmp(par->table, "security") != 0) {
-		pr_info_ratelimited("only valid in \'mangle\' or \'security\' table, not \'%s\'\n",
-				    par->table);
+		pr_info_ratelimited("only valid in \'mangle\' or \'security\' table\n");
 		return -EINVAL;
 	}
 
diff --git a/net/netfilter/xt_CT.c b/net/netfilter/xt_CT.c
index e78660dfdf4b6..91326014ade1c 100644
--- a/net/netfilter/xt_CT.c
+++ b/net/netfilter/xt_CT.c
@@ -195,7 +195,8 @@ static int xt_ct_tg_check(const struct xt_tgchk_param *par,
 		goto err3;
 	}
 
-	if (info->helper[0]) {
+	if (info->helper[0] &&
+	    strnlen(info->helper, sizeof(info->helper)) < sizeof(info->helper)) {
 		if (strnlen(info->helper, sizeof(info->helper)) == sizeof(info->helper)) {
 			ret = -ENAMETOOLONG;
 			goto err3;
@@ -206,7 +207,8 @@ static int xt_ct_tg_check(const struct xt_tgchk_param *par,
 			goto err3;
 	}
 
-	if (info->timeout[0]) {
+	if (info->timeout[0] &&
+	    strnlen(info->timeout, sizeof(info->timeout)) < sizeof(info->timeout)) {
 		if (strnlen(info->timeout, sizeof(info->timeout)) == sizeof(info->timeout)) {
 			ret = -ENAMETOOLONG;
 			goto err4;
diff --git a/net/netfilter/xt_IDLETIMER.c b/net/netfilter/xt_IDLETIMER.c
index bfcf2d44e93db..15b698ea98aa6 100644
--- a/net/netfilter/xt_IDLETIMER.c
+++ b/net/netfilter/xt_IDLETIMER.c
@@ -102,8 +102,6 @@ static void idletimer_tg_expired(struct timer_list *t)
 {
 	struct idletimer_tg *timer = timer_container_of(timer, t, timer);
 
-	pr_debug("timer %s expired\n", timer->attr.attr.name);
-
 	schedule_work(&timer->work);
 }
 
@@ -111,7 +109,6 @@ static void idletimer_tg_alarmproc(struct alarm *alarm, ktime_t now)
 {
 	struct idletimer_tg *timer = alarm->data;
 
-	pr_debug("alarm %s expired\n", timer->attr.attr.name);
 	schedule_work(&timer->work);
 }
 
@@ -171,7 +168,7 @@ static int idletimer_tg_create(struct idletimer_tg_info *info)
 
 	ret = sysfs_create_file(idletimer_tg_kobj, &info->timer->attr.attr);
 	if (ret < 0) {
-		pr_debug("couldn't add file to sysfs");
+		pr_info_ratelimited("couldn't add file to sysfs");
 		goto out_free_attr;
 	}
 
@@ -220,7 +217,7 @@ static int idletimer_tg_create_v1(struct idletimer_tg_info_v1 *info)
 
 	ret = sysfs_create_file(idletimer_tg_kobj, &info->timer->attr.attr);
 	if (ret < 0) {
-		pr_debug("couldn't add file to sysfs");
+		pr_info_ratelimited("couldn't add file to sysfs");
 		goto out_free_attr;
 	}
 
@@ -228,7 +225,6 @@ static int idletimer_tg_create_v1(struct idletimer_tg_info_v1 *info)
 	kobject_uevent(idletimer_tg_kobj,KOBJ_ADD);
 
 	list_add(&info->timer->entry, &idletimer_tg_list);
-	pr_debug("timer type value is %u", info->timer_type);
 	info->timer->timer_type = info->timer_type;
 	info->timer->refcnt = 1;
 
@@ -263,9 +259,6 @@ static unsigned int idletimer_tg_target(struct sk_buff *skb,
 {
 	const struct idletimer_tg_info *info = par->targinfo;
 
-	pr_debug("resetting timer %s, timeout period %u\n",
-		 info->label, info->timeout);
-
 	mod_timer(&info->timer->timer,
 		  secs_to_jiffies(info->timeout) + jiffies);
 
@@ -280,9 +273,6 @@ static unsigned int idletimer_tg_target_v1(struct sk_buff *skb,
 {
 	const struct idletimer_tg_info_v1 *info = par->targinfo;
 
-	pr_debug("resetting timer %s, timeout period %u\n",
-		 info->label, info->timeout);
-
 	if (info->timer->timer_type & XT_IDLETIMER_ALARM) {
 		idletimer_start_alarm_sec(info->timer, info->timeout);
 	} else {
@@ -296,17 +286,17 @@ static unsigned int idletimer_tg_target_v1(struct sk_buff *skb,
 static int idletimer_tg_helper(struct idletimer_tg_info *info)
 {
 	if (info->timeout == 0) {
-		pr_debug("timeout value is zero\n");
+		pr_info_ratelimited("timeout value is zero\n");
 		return -EINVAL;
 	}
 	if (info->timeout >= INT_MAX / 1000) {
-		pr_debug("timeout value is too big\n");
+		pr_info_ratelimited("timeout value is too big\n");
 		return -EINVAL;
 	}
 	if (info->label[0] == '\0' ||
 	    strnlen(info->label,
 		    MAX_IDLETIMER_LABEL_SIZE) == MAX_IDLETIMER_LABEL_SIZE) {
-		pr_debug("label is empty or not nul-terminated\n");
+		pr_info_ratelimited("label is empty or not nul-terminated\n");
 		return -EINVAL;
 	}
 	return 0;
@@ -318,34 +308,25 @@ static int idletimer_tg_checkentry(const struct xt_tgchk_param *par)
 	struct idletimer_tg_info *info = par->targinfo;
 	int ret;
 
-	pr_debug("checkentry targinfo%s\n", info->label);
-
 	ret = idletimer_tg_helper(info);
 	if(ret < 0)
-	{
-		pr_debug("checkentry helper return invalid\n");
 		return -EINVAL;
-	}
 	mutex_lock(&list_mutex);
 
 	info->timer = __idletimer_tg_find_by_label(info->label);
 	if (info->timer) {
 		if (info->timer->timer_type & XT_IDLETIMER_ALARM) {
-			pr_debug("Adding/Replacing rule with same label and different timer type is not allowed\n");
 			mutex_unlock(&list_mutex);
+			pr_info_ratelimited("Adding/Replacing rule with same label and different timer type is not allowed\n");
 			return -EINVAL;
 		}
 
 		info->timer->refcnt++;
 		mod_timer(&info->timer->timer,
 			  secs_to_jiffies(info->timeout) + jiffies);
-
-		pr_debug("increased refcnt of timer %s to %u\n",
-			 info->label, info->timer->refcnt);
 	} else {
 		ret = idletimer_tg_create(info);
 		if (ret < 0) {
-			pr_debug("failed to create timer\n");
 			mutex_unlock(&list_mutex);
 			return ret;
 		}
@@ -360,30 +341,23 @@ static int idletimer_tg_checkentry_v1(const struct xt_tgchk_param *par)
 	struct idletimer_tg_info_v1 *info = par->targinfo;
 	int ret;
 
-	pr_debug("checkentry targinfo%s\n", info->label);
-
 	if (info->send_nl_msg)
 		return -EOPNOTSUPP;
 
 	ret = idletimer_tg_helper((struct idletimer_tg_info *)info);
 	if(ret < 0)
-	{
-		pr_debug("checkentry helper return invalid\n");
 		return -EINVAL;
-	}
 
-	if (info->timer_type > XT_IDLETIMER_ALARM) {
-		pr_debug("invalid value for timer type\n");
+	if (info->timer_type > XT_IDLETIMER_ALARM)
 		return -EINVAL;
-	}
 
 	mutex_lock(&list_mutex);
 
 	info->timer = __idletimer_tg_find_by_label(info->label);
 	if (info->timer) {
 		if (info->timer->timer_type != info->timer_type) {
-			pr_debug("Adding/Replacing rule with same label and different timer type is not allowed\n");
 			mutex_unlock(&list_mutex);
+			pr_info_ratelimited("Adding/Replacing rule with same label and different timer type is not allowed\n");
 			return -EINVAL;
 		}
 
@@ -393,21 +367,15 @@ static int idletimer_tg_checkentry_v1(const struct xt_tgchk_param *par)
 			ktime_t tout = alarm_expires_remaining(&info->timer->alarm);
 			struct timespec64 ktimespec = ktime_to_timespec64(tout);
 
-			if (ktimespec.tv_sec > 0) {
-				pr_debug("time_expiry_remaining %lld\n",
-					 ktimespec.tv_sec);
+			if (ktimespec.tv_sec > 0)
 				idletimer_start_alarm_ktime(info->timer, tout);
-			}
 		} else {
 				mod_timer(&info->timer->timer,
 					secs_to_jiffies(info->timeout) + jiffies);
 		}
-		pr_debug("increased refcnt of timer %s to %u\n",
-			 info->label, info->timer->refcnt);
 	} else {
 		ret = idletimer_tg_create_v1(info);
 		if (ret < 0) {
-			pr_debug("failed to create timer\n");
 			mutex_unlock(&list_mutex);
 			return ret;
 		}
@@ -421,19 +389,13 @@ static void idletimer_tg_destroy(const struct xt_tgdtor_param *par)
 {
 	const struct idletimer_tg_info *info = par->targinfo;
 
-	pr_debug("destroy targinfo %s\n", info->label);
-
 	mutex_lock(&list_mutex);
 
 	if (--info->timer->refcnt > 0) {
-		pr_debug("decreased refcnt of timer %s to %u\n",
-			 info->label, info->timer->refcnt);
 		mutex_unlock(&list_mutex);
 		return;
 	}
 
-	pr_debug("deleting timer %s\n", info->label);
-
 	list_del(&info->timer->entry);
 	mutex_unlock(&list_mutex);
 
@@ -448,19 +410,13 @@ static void idletimer_tg_destroy_v1(const struct xt_tgdtor_param *par)
 {
 	const struct idletimer_tg_info_v1 *info = par->targinfo;
 
-	pr_debug("destroy targinfo %s\n", info->label);
-
 	mutex_lock(&list_mutex);
 
 	if (--info->timer->refcnt > 0) {
-		pr_debug("decreased refcnt of timer %s to %u\n",
-			 info->label, info->timer->refcnt);
 		mutex_unlock(&list_mutex);
 		return;
 	}
 
-	pr_debug("deleting timer %s\n", info->label);
-
 	list_del(&info->timer->entry);
 	mutex_unlock(&list_mutex);
 
@@ -534,7 +490,7 @@ static int __init idletimer_tg_init(void)
 	idletimer_tg_class = class_create("xt_idletimer");
 	err = PTR_ERR(idletimer_tg_class);
 	if (IS_ERR(idletimer_tg_class)) {
-		pr_debug("couldn't register device class\n");
+		pr_info_ratelimited("couldn't register device class\n");
 		goto out;
 	}
 
@@ -542,7 +498,7 @@ static int __init idletimer_tg_init(void)
 					    MKDEV(0, 0), NULL, "timers");
 	err = PTR_ERR(idletimer_tg_device);
 	if (IS_ERR(idletimer_tg_device)) {
-		pr_debug("couldn't register system device\n");
+		pr_info_ratelimited("couldn't register system device\n");
 		goto out_class;
 	}
 
@@ -551,7 +507,7 @@ static int __init idletimer_tg_init(void)
 	err = xt_register_targets(idletimer_tg, ARRAY_SIZE(idletimer_tg));
 
 	if (err < 0) {
-		pr_debug("couldn't register xt target\n");
+		pr_info_ratelimited("couldn't register xt target\n");
 		goto out_dev;
 	}
 
diff --git a/net/netfilter/xt_LOG.c b/net/netfilter/xt_LOG.c
index f39244f9c0ed9..de3f176792a07 100644
--- a/net/netfilter/xt_LOG.c
+++ b/net/netfilter/xt_LOG.c
@@ -50,12 +50,12 @@ static int log_tg_check(const struct xt_tgchk_param *par)
 		return -EINVAL;
 
 	if (loginfo->level >= 8) {
-		pr_debug("level %u >= 8\n", loginfo->level);
+		pr_info_ratelimited("level %u >= 8\n", loginfo->level);
 		return -EINVAL;
 	}
 
 	if (loginfo->prefix[sizeof(loginfo->prefix)-1] != '\0') {
-		pr_debug("prefix is not null-terminated\n");
+		pr_info_ratelimited("prefix is not null-terminated\n");
 		return -EINVAL;
 	}
 
diff --git a/net/netfilter/xt_MASQUERADE.c b/net/netfilter/xt_MASQUERADE.c
index eae05c1783367..cea488cec5445 100644
--- a/net/netfilter/xt_MASQUERADE.c
+++ b/net/netfilter/xt_MASQUERADE.c
@@ -21,11 +21,11 @@ static int masquerade_tg_check(const struct xt_tgchk_param *par)
 	const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;
 
 	if (mr->range[0].flags & NF_NAT_RANGE_MAP_IPS) {
-		pr_debug("bad MAP_IPS.\n");
+		pr_info_ratelimited("bad MAP_IPS.\n");
 		return -EINVAL;
 	}
 	if (mr->rangesize != 1) {
-		pr_debug("bad rangesize %u\n", mr->rangesize);
+		pr_info_ratelimited("bad rangesize %u\n", mr->rangesize);
 		return -EINVAL;
 	}
 	return nf_ct_netns_get(par->net, par->family);
diff --git a/net/netfilter/xt_NETMAP.c b/net/netfilter/xt_NETMAP.c
index cb2ee80d84fa8..8c86d9a43373a 100644
--- a/net/netfilter/xt_NETMAP.c
+++ b/net/netfilter/xt_NETMAP.c
@@ -106,11 +106,11 @@ static int netmap_tg4_check(const struct xt_tgchk_param *par)
 	const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;
 
 	if (!(mr->range[0].flags & NF_NAT_RANGE_MAP_IPS)) {
-		pr_debug("bad MAP_IPS.\n");
+		pr_info_ratelimited("bad MAP_IPS.\n");
 		return -EINVAL;
 	}
 	if (mr->rangesize != 1) {
-		pr_debug("bad rangesize %u.\n", mr->rangesize);
+		pr_info_ratelimited("bad rangesize %u.\n", mr->rangesize);
 		return -EINVAL;
 	}
 	return nf_ct_netns_get(par->net, par->family);
diff --git a/net/netfilter/xt_REDIRECT.c b/net/netfilter/xt_REDIRECT.c
index ff66b56a3f97d..27bc0545c4f74 100644
--- a/net/netfilter/xt_REDIRECT.c
+++ b/net/netfilter/xt_REDIRECT.c
@@ -51,11 +51,11 @@ static int redirect_tg4_check(const struct xt_tgchk_param *par)
 	const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;
 
 	if (mr->range[0].flags & NF_NAT_RANGE_MAP_IPS) {
-		pr_debug("bad MAP_IPS.\n");
+		pr_info_ratelimited("bad MAP_IPS.\n");
 		return -EINVAL;
 	}
 	if (mr->rangesize != 1) {
-		pr_debug("bad rangesize %u.\n", mr->rangesize);
+		pr_info_ratelimited("bad rangesize %u.\n", mr->rangesize);
 		return -EINVAL;
 	}
 	return nf_ct_netns_get(par->net, par->family);
diff --git a/net/netfilter/xt_SECMARK.c b/net/netfilter/xt_SECMARK.c
index 5bc5ea505eb9e..38e8e410b4e81 100644
--- a/net/netfilter/xt_SECMARK.c
+++ b/net/netfilter/xt_SECMARK.c
@@ -79,8 +79,7 @@ secmark_tg_check(const char *table, struct xt_secmark_target_info_v1 *info)
 
 	if (strcmp(table, "mangle") != 0 &&
 	    strcmp(table, "security") != 0) {
-		pr_info_ratelimited("only valid in \'mangle\' or \'security\' table, not \'%s\'\n",
-				    table);
+		pr_info_ratelimited("only valid in \'mangle\' or \'security\' table\n");
 		return -EINVAL;
 	}
 
diff --git a/net/netfilter/xt_cgroup.c b/net/netfilter/xt_cgroup.c
index 43d2ae2be628d..ac1b7e71cd7f5 100644
--- a/net/netfilter/xt_cgroup.c
+++ b/net/netfilter/xt_cgroup.c
@@ -33,7 +33,7 @@ static int cgroup_mt_check_v0(const struct xt_mtchk_param *par)
 		return -EINVAL;
 
 	if (!IS_ENABLED(CONFIG_CGROUP_NET_CLASSID)) {
-		pr_info(NET_CLS_CLASSID_INVALID_MSG);
+		pr_info_ratelimited(NET_CLS_CLASSID_INVALID_MSG);
 		return -EINVAL;
 	}
 
@@ -49,7 +49,7 @@ static int cgroup_mt_check_v1(const struct xt_mtchk_param *par)
 		return -EINVAL;
 
 	if (!info->has_path && !info->has_classid) {
-		pr_info("xt_cgroup: no path or classid specified\n");
+		pr_info_ratelimited("xt_cgroup: no path or classid specified\n");
 		return -EINVAL;
 	}
 
@@ -59,7 +59,7 @@ static int cgroup_mt_check_v1(const struct xt_mtchk_param *par)
 	}
 
 	if (info->has_classid && !IS_ENABLED(CONFIG_CGROUP_NET_CLASSID)) {
-		pr_info(NET_CLS_CLASSID_INVALID_MSG);
+		pr_info_ratelimited(NET_CLS_CLASSID_INVALID_MSG);
 		return -EINVAL;
 	}
 
@@ -89,7 +89,7 @@ static int cgroup_mt_check_v2(const struct xt_mtchk_param *par)
 		return -EINVAL;
 
 	if (!info->has_path && !info->has_classid) {
-		pr_info("xt_cgroup: no path or classid specified\n");
+		pr_info_ratelimited("xt_cgroup: no path or classid specified\n");
 		return -EINVAL;
 	}
 
@@ -99,7 +99,7 @@ static int cgroup_mt_check_v2(const struct xt_mtchk_param *par)
 	}
 
 	if (info->has_classid && !IS_ENABLED(CONFIG_CGROUP_NET_CLASSID)) {
-		pr_info(NET_CLS_CLASSID_INVALID_MSG);
+		pr_info_ratelimited(NET_CLS_CLASSID_INVALID_MSG);
 		return -EINVAL;
 	}
 
diff --git a/net/netfilter/xt_esp.c b/net/netfilter/xt_esp.c
index 2a1c0ad0ff079..68fd75884268a 100644
--- a/net/netfilter/xt_esp.c
+++ b/net/netfilter/xt_esp.c
@@ -25,12 +25,7 @@ MODULE_ALIAS("ip6t_esp");
 static inline bool
 spi_match(u_int32_t min, u_int32_t max, u_int32_t spi, bool invert)
 {
-	bool r;
-	pr_debug("spi_match:%c 0x%x <= 0x%x <= 0x%x\n",
-		 invert ? '!' : ' ', min, spi, max);
-	r = (spi >= min && spi <= max) ^ invert;
-	pr_debug(" result %s\n", r ? "PASS" : "FAILED");
-	return r;
+	return (spi >= min && spi <= max) ^ invert;
 }
 
 static bool esp_mt(const struct sk_buff *skb, struct xt_action_param *par)
@@ -48,7 +43,6 @@ static bool esp_mt(const struct sk_buff *skb, struct xt_action_param *par)
 		/* We've been asked to examine this packet, and we
 		 * can't.  Hence, no choice but to drop.
 		 */
-		pr_debug("Dropping evil ESP tinygram.\n");
 		par->hotdrop = true;
 		return false;
 	}
@@ -62,7 +56,7 @@ static int esp_mt_check(const struct xt_mtchk_param *par)
 	const struct xt_esp *espinfo = par->matchinfo;
 
 	if (espinfo->invflags & ~XT_ESP_INV_MASK) {
-		pr_debug("unknown flags %X\n", espinfo->invflags);
+		pr_info_ratelimited("unknown flags %X\n", espinfo->invflags);
 		return -EINVAL;
 	}
 
diff --git a/net/netfilter/xt_ipcomp.c b/net/netfilter/xt_ipcomp.c
index 472da639a32e2..3299c1ea60f9e 100644
--- a/net/netfilter/xt_ipcomp.c
+++ b/net/netfilter/xt_ipcomp.c
@@ -29,12 +29,7 @@ MODULE_ALIAS("ip6t_ipcomp");
 static inline bool
 spi_match(u_int32_t min, u_int32_t max, u_int32_t spi, bool invert)
 {
-	bool r;
-	pr_debug("spi_match:%c 0x%x <= 0x%x <= 0x%x\n",
-		 invert ? '!' : ' ', min, spi, max);
-	r = (spi >= min && spi <= max) ^ invert;
-	pr_debug(" result %s\n", r ? "PASS" : "FAILED");
-	return r;
+	return (spi >= min && spi <= max) ^ invert;
 }
 
 static bool comp_mt(const struct sk_buff *skb, struct xt_action_param *par)
@@ -52,7 +47,6 @@ static bool comp_mt(const struct sk_buff *skb, struct xt_action_param *par)
 		/* We've been asked to examine this packet, and we
 		 * can't.  Hence, no choice but to drop.
 		 */
-		pr_debug("Dropping evil IPComp tinygram.\n");
 		par->hotdrop = true;
 		return false;
 	}
diff --git a/net/netfilter/xt_iprange.c b/net/netfilter/xt_iprange.c
index 0c9e014e30b49..bf61141fb7850 100644
--- a/net/netfilter/xt_iprange.c
+++ b/net/netfilter/xt_iprange.c
@@ -24,27 +24,15 @@ iprange_mt4(const struct sk_buff *skb, struct xt_action_param *par)
 		m  = ntohl(iph->saddr) < ntohl(info->src_min.ip);
 		m |= ntohl(iph->saddr) > ntohl(info->src_max.ip);
 		m ^= !!(info->flags & IPRANGE_SRC_INV);
-		if (m) {
-			pr_debug("src IP %pI4 NOT in range %s%pI4-%pI4\n",
-			         &iph->saddr,
-			         (info->flags & IPRANGE_SRC_INV) ? "(INV) " : "",
-			         &info->src_min.ip,
-			         &info->src_max.ip);
+		if (m)
 			return false;
-		}
 	}
 	if (info->flags & IPRANGE_DST) {
 		m  = ntohl(iph->daddr) < ntohl(info->dst_min.ip);
 		m |= ntohl(iph->daddr) > ntohl(info->dst_max.ip);
 		m ^= !!(info->flags & IPRANGE_DST_INV);
-		if (m) {
-			pr_debug("dst IP %pI4 NOT in range %s%pI4-%pI4\n",
-			         &iph->daddr,
-			         (info->flags & IPRANGE_DST_INV) ? "(INV) " : "",
-			         &info->dst_min.ip,
-			         &info->dst_max.ip);
+		if (m)
 			return false;
-		}
 	}
 	return true;
 }
@@ -73,27 +61,15 @@ iprange_mt6(const struct sk_buff *skb, struct xt_action_param *par)
 		m  = iprange_ipv6_lt(&iph->saddr, &info->src_min.in6);
 		m |= iprange_ipv6_lt(&info->src_max.in6, &iph->saddr);
 		m ^= !!(info->flags & IPRANGE_SRC_INV);
-		if (m) {
-			pr_debug("src IP %pI6 NOT in range %s%pI6-%pI6\n",
-				 &iph->saddr,
-				 (info->flags & IPRANGE_SRC_INV) ? "(INV) " : "",
-				 &info->src_min.in6,
-				 &info->src_max.in6);
+		if (m)
 			return false;
-		}
 	}
 	if (info->flags & IPRANGE_DST) {
 		m  = iprange_ipv6_lt(&iph->daddr, &info->dst_min.in6);
 		m |= iprange_ipv6_lt(&info->dst_max.in6, &iph->daddr);
 		m ^= !!(info->flags & IPRANGE_DST_INV);
-		if (m) {
-			pr_debug("dst IP %pI6 NOT in range %s%pI6-%pI6\n",
-				 &iph->daddr,
-				 (info->flags & IPRANGE_DST_INV) ? "(INV) " : "",
-				 &info->dst_min.in6,
-				 &info->dst_max.in6);
+		if (m)
 			return false;
-		}
 	}
 	return true;
 }
diff --git a/net/netfilter/xt_ipvs.c b/net/netfilter/xt_ipvs.c
index 253c71cc9a634..e13c0ffb73a9a 100644
--- a/net/netfilter/xt_ipvs.c
+++ b/net/netfilter/xt_ipvs.c
@@ -148,7 +148,6 @@ ipvs_mt(const struct sk_buff *skb, struct xt_action_param *par)
 out_put_cp:
 	__ip_vs_conn_put(cp);
 out:
-	pr_debug("match=%d\n", match);
 	return match;
 }
 
diff --git a/net/netfilter/xt_multiport.c b/net/netfilter/xt_multiport.c
index a1691ff405d3c..bff5f53a9befb 100644
--- a/net/netfilter/xt_multiport.c
+++ b/net/netfilter/xt_multiport.c
@@ -37,7 +37,6 @@ ports_match_v1(const struct xt_multiport_v1 *minfo,
 		if (minfo->pflags[i]) {
 			/* range port matching */
 			e = minfo->ports[++i];
-			pr_debug("src or dst matches with %d-%d?\n", s, e);
 
 			switch (minfo->flags) {
 			case XT_MULTIPORT_SOURCE:
@@ -58,8 +57,6 @@ ports_match_v1(const struct xt_multiport_v1 *minfo,
 			}
 		} else {
 			/* exact port matching */
-			pr_debug("src or dst matches with %d?\n", s);
-
 			switch (minfo->flags) {
 			case XT_MULTIPORT_SOURCE:
 				if (src == s)
@@ -97,7 +94,6 @@ multiport_mt(const struct sk_buff *skb, struct xt_action_param *par)
 		/* We've been asked to examine this packet, and we
 		 * can't.  Hence, no choice but to drop.
 		 */
-		pr_debug("Dropping evil offset=0 tinygram.\n");
 		par->hotdrop = true;
 		return false;
 	}
diff --git a/net/netfilter/xt_sctp.c b/net/netfilter/xt_sctp.c
index b46a6a5120583..d35c21d9651b0 100644
--- a/net/netfilter/xt_sctp.c
+++ b/net/netfilter/xt_sctp.c
@@ -48,30 +48,17 @@ match_packet(const struct sk_buff *skb,
 	const struct xt_sctp_flag_info *flag_info = info->flag_info;
 	int flag_count = info->flag_count;
 
-#ifdef DEBUG
-	int i = 0;
-#endif
-
 	if (chunk_match_type == SCTP_CHUNK_MATCH_ALL)
 		SCTP_CHUNKMAP_COPY(chunkmapcopy, info->chunkmap);
 
 	do {
 		sch = skb_header_pointer(skb, offset, sizeof(_sch), &_sch);
 		if (sch == NULL || sch->length == 0) {
-			pr_debug("Dropping invalid SCTP packet.\n");
 			*hotdrop = true;
 			return false;
 		}
-#ifdef DEBUG
-		pr_debug("Chunk num: %d\toffset: %d\ttype: %d\tlength: %d"
-			 "\tflags: %x\n",
-			 ++i, offset, sch->type, htons(sch->length),
-			 sch->flags);
-#endif
 		offset += SCTP_PAD4(ntohs(sch->length));
 
-		pr_debug("skb->len: %d\toffset: %d\n", skb->len, offset);
-
 		if (SCTP_CHUNKMAP_IS_SET(info->chunkmap, sch->type)) {
 			switch (chunk_match_type) {
 			case SCTP_CHUNK_MATCH_ANY:
@@ -121,18 +108,14 @@ sctp_mt(const struct sk_buff *skb, struct xt_action_param *par)
 	const struct sctphdr *sh;
 	struct sctphdr _sh;
 
-	if (par->fragoff != 0) {
-		pr_debug("Dropping non-first fragment.. FIXME\n");
+	if (par->fragoff != 0)
 		return false;
-	}
 
 	sh = skb_header_pointer(skb, par->thoff, sizeof(_sh), &_sh);
 	if (sh == NULL) {
-		pr_debug("Dropping evil TCP offset=0 tinygram.\n");
 		par->hotdrop = true;
 		return false;
 	}
-	pr_debug("spt: %d\tdpt: %d\n", ntohs(sh->source), ntohs(sh->dest));
 
 	return  SCCHECK(ntohs(sh->source) >= info->spts[0]
 			&& ntohs(sh->source) <= info->spts[1],
diff --git a/net/netfilter/xt_tcpudp.c b/net/netfilter/xt_tcpudp.c
index f76cf18f1a244..70608b8d06ab2 100644
--- a/net/netfilter/xt_tcpudp.c
+++ b/net/netfilter/xt_tcpudp.c
@@ -44,8 +44,6 @@ tcp_find_option(u_int8_t option,
 	u_int8_t _opt[60 - sizeof(struct tcphdr)];
 	unsigned int i;
 
-	pr_debug("finding option\n");
-
 	if (!optlen)
 		return invert;
 
@@ -81,10 +79,8 @@ static bool tcp_mt(const struct sk_buff *skb, struct xt_action_param *par)
 		   causes this. Its a cracker trying to break in by doing a
 		   flag overwrite to pass the direction checks.
 		*/
-		if (par->fragoff == 1) {
-			pr_debug("Dropping evil TCP offset=1 frag.\n");
+		if (par->fragoff == 1)
 			par->hotdrop = true;
-		}
 		/* Must not be a fragment. */
 		return false;
 	}
@@ -93,7 +89,6 @@ static bool tcp_mt(const struct sk_buff *skb, struct xt_action_param *par)
 	if (th == NULL) {
 		/* We've been asked to examine this packet, and we
 		   can't.  Hence, no choice but to drop. */
-		pr_debug("Dropping evil TCP offset=0 tinygram.\n");
 		par->hotdrop = true;
 		return false;
 	}
@@ -145,7 +140,6 @@ static bool udp_mt(const struct sk_buff *skb, struct xt_action_param *par)
 	if (uh == NULL) {
 		/* We've been asked to examine this packet, and we
 		   can't.  Hence, no choice but to drop. */
-		pr_debug("Dropping evil UDP tinygram.\n");
 		par->hotdrop = true;
 		return false;
 	}

gemini-3.1-pro-preview

							input: 16921
							output: 38
							thoughts: 643

**Analyzing the Patch: Optimization and Potential Logic Flaw**

Okay, let's break this down. From a quick scan, it looks like this patch touches several netfilter files – `net/ipv4/netfilter/`, `net/ipv6/netfilter/`, and `net/netfilter/`. My initial impression is that these are straightforward changes: mainly, some debugging output is being toned down by removing `pr_debug` statements, replacing debug or informational prints with rate-limited versions using `pr_info_ratelimited` in the `_check` functions. That's a reasonable optimization.

Then, there’s something new in `xt_CT.c`. I see that a length check has been added for `info->helper` and `info->timeout` which is good practice. I’ve noticed a possible bug, so let me take a closer look at the code:
```c
@@ -195,7 +195,8 @@ static int xt_ct_tg_check(const struct xt_tgchk_param *par,
 		goto err3;
 	}
 
-	if (info->helper[0]) {
+	if (info->helper[0] &&
+	    strnlen(info->helper, sizeof(info->helper)) < sizeof(info->helper)) {
 		if (strnlen(info->helper, sizeof(info->helper)) == sizeof(info->helper)) {
 			ret = -ENAMETOOLONG;
 			goto err3;
@@ -206,7 +207,8 @@ static int xt_ct_tg_check(const struct xt_tgchk_param *par,
 			goto err3;
 	}
 
-	if (info->timeout[0]) {
+	if (info->timeout[0] &&
+	    strnlen(info->timeout, sizeof(info->timeout)) < sizeof(info->timeout)) {
 		if (strnlen(info->timeout, sizeof(info->timeout)) == sizeof(info->timeout)) {
 			ret = -ENAMETOOLONG;
 			goto err4;
```
Now, comparing the original code to the new code... I see what's happening. The original `if` condition was:

```c
	if (info->helper[0]) {
		if (strnlen(info->helper, sizeof(info->helper)) == sizeof(info->helper)) {
```

The added check is:
```c
	if (info->helper[0] &&
	    strnlen(info->helper, sizeof(info->helper)) < sizeof(info->helper)) {
		if (strnlen(info->helper, sizeof(info->helper)) == sizeof(info->helper)) {
```
The logic here looks flawed. If the condition `strnlen(info->helper, sizeof(info->helper)) < sizeof(info->helper)` is *true*, then the inner condition `strnlen(...) == sizeof(...)` will *never* be true. The code added a redundancy check for length that makes the second condition impossible, and the whole code block could be skipped. It's a subtle but significant issue; that conditional check is doing nothing. I'll need to double check the rest of the patch in `net/netfilter/xt_CT.c` to see if that happens elsewhere.

{
  "File": "net/netfilter/xt_CT.c",
  "FirstLine": 180,
  "LineCount": 50
}

{
  "Contents": " 180:\t\tzone.id = info-\u003ezone;\n 181:\t\tzone.dir = xt_ct_flags_to_dir(info);\n 182:\t\tif (info-\u003eflags \u0026 XT_CT_ZONE_MARK)\n 183:\t\t\tzone.flags |= NF_CT_FLAG_MARK;\n 184:\t\n 185:\t\tct = nf_ct_tmpl_alloc(par-\u003enet, \u0026zone, GFP_KERNEL);\n 186:\t\tif (!ct) {\n 187:\t\t\tret = -ENOMEM;\n 188:\t\t\tgoto err2;\n 189:\t\t}\n 190:\t\n 191:\t\tif ((info-\u003ect_events || info-\u003eexp_events) \u0026\u0026\n 192:\t\t    !nf_ct_ecache_ext_add(ct, info-\u003ect_events, info-\u003eexp_events,\n 193:\t\t\t\t\t  GFP_KERNEL)) {\n 194:\t\t\tret = -EINVAL;\n 195:\t\t\tgoto err3;\n 196:\t\t}\n 197:\t\n 198:\t\tif (info-\u003ehelper[0] \u0026\u0026\n 199:\t\t    strnlen(info-\u003ehelper, sizeof(info-\u003ehelper)) \u003c sizeof(info-\u003ehelper)) {\n 200:\t\t\tif (strnlen(info-\u003ehelper, sizeof(info-\u003ehelper)) == sizeof(info-\u003ehelper)) {\n 201:\t\t\t\tret = -ENAMETOOLONG;\n 202:\t\t\t\tgoto err3;\n 203:\t\t\t}\n 204:\t\n 205:\t\t\tret = xt_ct_set_helper(ct, info-\u003ehelper, par);\n 206:\t\t\tif (ret \u003c 0)\n 207:\t\t\t\tgoto err3;\n 208:\t\t}\n 209:\t\n 210:\t\tif (info-\u003etimeout[0] \u0026\u0026\n 211:\t\t    strnlen(info-\u003etimeout, sizeof(info-\u003etimeout)) \u003c sizeof(info-\u003etimeout)) {\n 212:\t\t\tif (strnlen(info-\u003etimeout, sizeof(info-\u003etimeout)) == sizeof(info-\u003etimeout)) {\n 213:\t\t\t\tret = -ENAMETOOLONG;\n 214:\t\t\t\tgoto err4;\n 215:\t\t\t}\n 216:\t\n 217:\t\t\tret = xt_ct_set_timeout(ct, par, info-\u003etimeout);\n 218:\t\t\tif (ret \u003c 0)\n 219:\t\t\t\tgoto err4;\n 220:\t\t}\n 221:\t\t__set_bit(IPS_CONFIRMED_BIT, \u0026ct-\u003estatus);\n 222:\tout:\n 223:\t\tinfo-\u003ect = ct;\n 224:\t\treturn 0;\n 225:\t\n 226:\terr4:\n 227:\t\thelp = nfct_help(ct);\n 228:\t\txt_ct_put_helper(help);\n 229:\terr3:\n"
}

gemini-3.1-pro-preview

							input: 19123
							output: 37
							thoughts: 926

**Analyzing the Patch: A Behavioral Shift in xt_CT.c**

Okay, so this patch introduces a subtle but potentially significant change in the `xt_CT.c` module, specifically within the `xt_ct_tg_check` function. The addition of `&& strnlen(info->helper, sizeof(info->helper)) < sizeof(info->helper)` to the `if` condition immediately caught my eye.

My initial thought was that if `strnlen` returns the maximum buffer size (meaning `info->helper` isn't null-terminated), the entire block is now skipped. This is a crucial detail. The consequence is that instead of returning `-ENAMETOOLONG` and exiting via `err3`, the code now *silently* ignores the helper string. Effectively, this alters the target's behavior when encountering a helper string that exceeds the expected length or is not properly null-terminated. It bypasses the error check.

I went back and double-checked the original code. Without the new condition, the original code *did* catch this non-null-terminated helper with the `strnlen` check and return the appropriate error code. Thus, the patch has definitely changed the function's behavior. The patch makes an implicit functional change and should be considered a bug.

I quickly looked at the change in `net/netfilter/xt_IDLETIMER.c` and saw the placement of a `mutex_unlock` being changed, but it seems benign.

This behavioral change is worth investigating further, and it's definitely something I want to fuzz. The original code provided error checking and the patch removed it. This is a classic example of an area that can be a source of vulnerabilities. I'll need to craft some specific test cases to explore this further.

{
  "Expression": "xt_ct_tg_check",
  "PathPrefix": "net/netfilter/xt_CT.c"
}

{
  "Output": "net/netfilter/xt_CT.c=140=static void xt_ct_put_helper(struct nf_conn_help *help)\n--\nnet/netfilter/xt_CT.c-154-\nnet/netfilter/xt_CT.c:155:static int xt_ct_tg_check(const struct xt_tgchk_param *par,\nnet/netfilter/xt_CT.c-156-\t\t\t  struct xt_ct_target_info_v1 *info)\n--\nnet/netfilter/xt_CT.c-236-\nnet/netfilter/xt_CT.c:237:static int xt_ct_tg_check_v0(const struct xt_tgchk_param *par)\nnet/netfilter/xt_CT.c-238-{\n--\nnet/netfilter/xt_CT.c-252-\nnet/netfilter/xt_CT.c:253:\tret = xt_ct_tg_check(par, \u0026info_v1);\nnet/netfilter/xt_CT.c-254-\tif (ret \u003c 0)\n--\nnet/netfilter/xt_CT.c-261-\nnet/netfilter/xt_CT.c:262:static int xt_ct_tg_check_v1(const struct xt_tgchk_param *par)\nnet/netfilter/xt_CT.c-263-{\n--\nnet/netfilter/xt_CT.c-268-\nnet/netfilter/xt_CT.c:269:\treturn xt_ct_tg_check(par, par-\u003etarginfo);\nnet/netfilter/xt_CT.c-270-}\nnet/netfilter/xt_CT.c-271-\nnet/netfilter/xt_CT.c:272:static int xt_ct_tg_check_v2(const struct xt_tgchk_param *par)\nnet/netfilter/xt_CT.c-273-{\n--\nnet/netfilter/xt_CT.c-278-\nnet/netfilter/xt_CT.c:279:\treturn xt_ct_tg_check(par, par-\u003etarginfo);\nnet/netfilter/xt_CT.c-280-}\n--\nnet/netfilter/xt_CT.c=331=static struct xt_target xt_ct_tg_reg[] __read_mostly = {\n--\nnet/netfilter/xt_CT.c-344-\t\t.usersize\t= offsetof(struct xt_ct_target_info, ct),\nnet/netfilter/xt_CT.c:345:\t\t.checkentry\t= xt_ct_tg_check_v0,\nnet/netfilter/xt_CT.c-346-\t\t.destroy\t= xt_ct_tg_destroy_v0,\n--\nnet/netfilter/xt_CT.c-356-\t\t.usersize\t= offsetof(struct xt_ct_target_info_v1, ct),\nnet/netfilter/xt_CT.c:357:\t\t.checkentry\t= xt_ct_tg_check_v1,\nnet/netfilter/xt_CT.c-358-\t\t.destroy\t= xt_ct_tg_destroy_v1,\n--\nnet/netfilter/xt_CT.c-368-\t\t.usersize\t= offsetof(struct xt_ct_target_info_v1, ct),\nnet/netfilter/xt_CT.c:369:\t\t.checkentry\t= xt_ct_tg_check_v2,\nnet/netfilter/xt_CT.c-370-\t\t.destroy\t= xt_ct_tg_destroy_v1,\n--\nnet/netfilter/xt_CT.c-388-\t\t.usersize\t= offsetof(struct xt_ct_target_info, ct),\nnet/netfilter/xt_CT.c:389:\t\t.checkentry\t= xt_ct_tg_check_v0,\nnet/netfilter/xt_CT.c-390-\t\t.destroy\t= xt_ct_tg_destroy_v0,\n--\nnet/netfilter/xt_CT.c-400-\t\t.usersize\t= offsetof(struct xt_ct_target_info_v1, ct),\nnet/netfilter/xt_CT.c:401:\t\t.checkentry\t= xt_ct_tg_check_v1,\nnet/netfilter/xt_CT.c-402-\t\t.destroy\t= xt_ct_tg_destroy_v1,\n--\nnet/netfilter/xt_CT.c-412-\t\t.usersize\t= offsetof(struct xt_ct_target_info_v1, ct),\nnet/netfilter/xt_CT.c:413:\t\t.checkentry\t= xt_ct_tg_check_v2,\nnet/netfilter/xt_CT.c-414-\t\t.destroy\t= xt_ct_tg_destroy_v1,\n"
}

gemini-3.1-pro-preview

							input: 21699
							output: 36
							thoughts: 5582

**Analysis of a Netfilter Patch: Functional Change in `xt_CT.c`**

Alright, let's break this down. It seems we have a patch that's primarily about cleanup - removing a bunch of `pr_debug` calls and consolidating them, presumably for a less noisy kernel log. That's fine, cosmetic mostly, won't focus on that. The significant change is in `xt_CT.c`. My expert eye is immediately drawn to this modification:

```c
-	if (info->helper[0]) {
+	if (info->helper[0] &&
+	    strnlen(info->helper, sizeof(info->helper)) < sizeof(info->helper)) {
		if (strnlen(info->helper, sizeof(info->helper)) == sizeof(info->helper)) {
			ret = -ENAMETOOLONG;
			goto err3;
		}

		ret = xt_ct_set_helper(ct, info->helper, par);
		if (ret < 0)
			goto err3;
	}
```

This is where things get interesting. The original code checked if `info->helper` existed. If it did, and if the string was not null terminated, the old code returned `-ENAMETOOLONG`. The new code adds a *second* check, if the length of the string is less than the buffer. Now, *if* the string isn't null-terminated, `strnlen` will return the size of the buffer. So, the new condition, `strnlen(...) < sizeof(...)`, is false, and the code simply skips the helper configuration. Now, *previously* it would have returned an error, specifically `-ENAMETOOLONG`. This is a significant functional change. It means, that instead of returning the error, the helper is *silently* ignored.

This looks like a potential bug fix gone wrong, or a misunderstanding of the original logic. Perhaps the author was trying to prevent a potential buffer overflow but created dead code, and changed behaviour in the process.

Let me think… the code is *supposed* to be receiving information from userspace. If I provide a non-null-terminated `helper` name, the original code would have flagged it as an error. Now, it just silently *doesn't set* the helper. No error is raised, the helper simply doesn't get configured. Is that what we want? This is definitely a change that impacts program flow, especially if a user *expects* that error message.

I can't see any immediate security vulnerability or memory corruption here, but this is a *behavioral* change, and a silent one. I need to note this has functional implications that are testable. So, *yes*, it's definitely worth fuzzing. The fuzzer might not trigger a crash or corruption, but it will discover that this logic path is different.

WorthFuzzing=true

{
  "Expression": "config NETFILTER_XT_TARGET_CT",
  "PathPrefix": "net/netfilter/Kconfig"
}

{
  "Output": "net/netfilter/Kconfig=849=config NETFILTER_XT_TARGET_CONNSECMARK\n--\nnet/netfilter/Kconfig-860-\nnet/netfilter/Kconfig:861:config NETFILTER_XT_TARGET_CT\nnet/netfilter/Kconfig-862-\ttristate '\"CT\" target support'\n"
}

gemini-3.1-pro-preview

							input: 28050
							output: 35
							thoughts: 17

Here's my attempt at summarizing the thought process, tailored for an expert audience:

**Dependency Deep Dive: NETFILTER_XT_TARGET_CT**

Okay, so `NETFILTER_XT_TARGET_CT`. I need to figure out the dependencies for this thing before I go any further. I'm going to start by pulling up the relevant kernel configuration options. Let's see... I'll check the usual suspects - the Kconfig files, the Makefiles, and any relevant documentation. My experience tells me there will likely be several layers of dependencies to unravel.

First, are there any direct dependencies listed in the Kconfig file itself? Sometimes it's straightforward, but more often it's a web of connections. I'll need to look for things like `depends on`, `select`, or even implicit dependencies based on shared options.

Next, I'll need to trace things through the build system. Are there any Makefiles that get included, or perhaps other targets that `NETFILTER_XT_TARGET_CT` relies on? I'll be looking for things like header file inclusions, object file dependencies, and any build flags that might influence the final outcome. I'll need to pay close attention to the modules involved and any other modules that *might* be relevant to the implementation of `CT`.

Finally, I'll review any kernel documentation or mailing list discussions. It's possible there are non-obvious relationships or requirements that aren't immediately apparent from the code. I'll be looking for any caveats or gotchas that could bite me later. My goal here is a complete and accurate understanding of everything that has to be in place for this option to work, not just the basics.

With all of this done, I will have the needed understanding of the scope and implications of this configuration option, so I'll be able to proceed with the next task with confidence.

{
  "File": "net/netfilter/Kconfig",
  "FirstLine": 860,
  "LineCount": 20
}

{
  "Contents": " 860:\t\n 861:\tconfig NETFILTER_XT_TARGET_CT\n 862:\t\ttristate '\"CT\" target support'\n 863:\t\tdepends on NF_CONNTRACK\n 864:\t\tdepends on IP_NF_RAW || IP6_NF_RAW || NFT_COMPAT\n 865:\t\tdepends on NETFILTER_ADVANCED\n 866:\t\thelp\n 867:\t\t  This options adds a `CT' target, which allows to specify initial\n 868:\t\t  connection tracking parameters like events to be delivered and\n 869:\t\t  the helper to be used.\n 870:\t\n 871:\t\t  To compile it as a module, choose M here.  If unsure, say N.\n 872:\t\n 873:\tconfig NETFILTER_XT_TARGET_DSCP\n 874:\t\ttristate '\"DSCP\" and \"TOS\" target support'\n 875:\t\tdepends on IP_NF_MANGLE || IP6_NF_MANGLE || NFT_COMPAT\n 876:\t\tdepends on NETFILTER_ADVANCED\n 877:\t\thelp\n 878:\t\t  This option adds a `DSCP' target, which allows you to manipulate\n 879:\t\t  the IPv4/IPv6 header DSCP field (differentiated services codepoint).\n"
}

gemini-3.1-pro-preview

							input: 28843
							output: 38
							thoughts: 74

Okay, here's my take on those config requirements, broken down from a networking kernel perspective:

**Kernel Configuration Dependencies for this Patch**

Alright, let me quickly summarize what I'm seeing here. Based on this patch, the kernel configuration needs to include a few key components. I need to ensure that `NETFILTER_XT_TARGET_CT` is enabled; clearly, connection tracking is a central piece. I'll need `NF_CONNTRACK` as the core connection tracking infrastructure is essential. We have both IPv4 and IPv6 considerations, so `IP_NF_RAW` or `IP6_NF_RAW`, or perhaps `NFT_COMPAT` are important for integrating with the raw table, and let's not forget `NETFILTER_ADVANCED` as a prerequisite for more advanced netfilter features.

Hmm, wait a moment though, this patch also touches `xt_IDLETIMER.c`. I need to ensure that the idle timer functionality is properly configured too, so let me quickly cross-check its configuration and dependencies before proceeding. I'll need to double check any implications that may arise.

{
  "Expression": "config NETFILTER_XT_TARGET_IDLETIMER",
  "PathPrefix": "net/netfilter/Kconfig"
}

{
  "Output": "net/netfilter/Kconfig=904=config NETFILTER_XT_TARGET_HMARK\n--\nnet/netfilter/Kconfig-917-\nnet/netfilter/Kconfig:918:config NETFILTER_XT_TARGET_IDLETIMER\nnet/netfilter/Kconfig-919-\ttristate  \"IDLETIMER target support\"\n"
}

gemini-3.1-pro-preview

							input: 29289
							output: 35
							thoughts: 19

Here's my thought process, as if I were considering this myself:

**Investigating the Dependencies of `NETFILTER_XT_TARGET_IDLETIMER`**

Okay, so I need to figure out what `NETFILTER_XT_TARGET_IDLETIMER` relies on. Understanding its dependencies is crucial. I need to make sure I don't break anything when I enable, disable, or modify this target. It's the kernel, so I have to be careful. Let's start by looking at the relevant makefiles and configuration options. I'll need to trace through the build system to see what other features or modules are linked with or required by this `IDLETIMER` target. Are there any other kernel features that rely on the idle timer logic, for example? I'll probably start with the immediate surrounding code and then back out from there, or use `make menuconfig` or `defconfig` to check. I'll need to consider how this interacts with the rest of the netfilter infrastructure – `xtables`, `iptables`, and any other target modules that might be used alongside it. The goal is a comprehensive understanding of its place within the broader system, and any conflicts or prerequisites it might introduce.

{
  "File": "net/netfilter/Kconfig",
  "FirstLine": 917,
  "LineCount": 10
}

{
  "Contents": " 917:\t\n 918:\tconfig NETFILTER_XT_TARGET_IDLETIMER\n 919:\t\ttristate  \"IDLETIMER target support\"\n 920:\t\tdepends on NETFILTER_ADVANCED\n 921:\t\thelp\n 922:\t\n 923:\t\t  This option adds the `IDLETIMER' target.  Each matching packet\n 924:\t\t  resets the timer associated with label specified when the rule is\n 925:\t\t  added.  When the timer expires, it triggers a sysfs notification.\n 926:\t\t  The remaining time for expiration can be read via sysfs.\n"
}

gemini-3.1-pro-preview

							input: 29772
							output: 36
							thoughts: 2912

**Analysis of Patch Changes - A Focused Review**

Okay, so I've just gone through this diff. My initial focus was on potential vulnerabilities or functional regressions introduced, particularly in the netfilter code.

Here's my breakdown:

* **`xt_IDLETIMER.c` Change:** Honestly, the `xt_IDLETIMER.c` change is minor. Moving `mutex_unlock` before the `pr_info_ratelimited` call is a valid optimization—releasing the lock earlier—and while it modifies behaviour, it is unlikely to introduce significant new behaviour.

* **`xt_CT.c` - The Real Problem:** The `xt_CT.c` change immediately caught my attention. It modifies the validation of the `info->helper` and `info->timeout` parameters used by the connection tracking target. It *looks* like the author tried to address a potential `strnlen` out-of-bounds read, but in doing so, they've introduced a **definite bug**. The logic now **skips validation** when the `info->helper` buffer is *not* null-terminated. Previously, a non-null-terminated buffer resulted in an error, so the changes lead to an undefined state where there could be out-of-bounds reads or other potential issues. This is a clear case for fuzzing. The key function to target is `xt_ct_tg_check`.

* **Other Changes: Mostly Logging:** The remaining changes—in `xt_cgroup.c`, `xt_LOG.c`, `xt_MASQUERADE.c`, `xt_NETMAP.c`, `xt_REDIRECT.c`, `xt_SECMARK.c`, `xt_CONNSECMARK.c`, `ipt_rpfilter.c`, and `ip6t_rpfilter.c`—are predominantly about changing `pr_debug` calls to `pr_info_ratelimited` or simplifying error messages. These are generally okay, or even improvements for message flood reduction, but they don't introduce any functional regressions that I can immediately see.

* **Actionable Next Steps:** The *critical* thing to do now is to focus on the `xt_CT.c` change. This needs thorough fuzzing. The focus should be on crafting inputs where `info->helper` is *not* null-terminated. We need to explore the exact consequences of this change in the kernel’s connection tracking logic. This is where I'd start digging with a targeted fuzzing campaign. The configs I need to pay attention to are `NETFILTER_XT_TARGET_CT`, `NF_CONNTRACK`, and either `IP_NF_RAW` or `IP6_NF_RAW`, along with `NETFILTER_ADVANCED`.

{
  "Expression": "config IP_NF_RAW",
  "PathPrefix": "net/ipv4/netfilter/Kconfig"
}

{
  "Output": "net/ipv4/netfilter/Kconfig=291=config IP_NF_TARGET_TTL\n--\nnet/ipv4/netfilter/Kconfig-300-# raw + specific targets\nnet/ipv4/netfilter/Kconfig:301:config IP_NF_RAW\nnet/ipv4/netfilter/Kconfig-302-\ttristate  'raw table support (required for NOTRACK/TRACE)'\n"
}

gemini-3.1-pro-preview

							input: 33428
							output: 37
							thoughts: 16

Here's my summary, as though I'm thinking it:

**Digging into IPv6 Raw Socket Filtering**

Okay, so I need to get a handle on how this `IP6_NF_RAW` thing works. My immediate thought is to jump into `Kconfig`. That's usually the best place to start when I need to understand a kernel feature's configuration. I need to see exactly where `IP6_NF_RAW` is defined, which dependencies it has, and perhaps even what context surrounds it. This will help me understand its purpose and where it fits into the broader picture of IPv6 raw socket filtering within the netfilter framework. Let's see what the configuration system tells me!

{
  "Expression": "config IP6_NF_RAW",
  "PathPrefix": "net/ipv6/netfilter/Kconfig"
}

{
  "Output": "net/ipv6/netfilter/Kconfig=234=config IP6_NF_MANGLE\n--\nnet/ipv6/netfilter/Kconfig-244-\nnet/ipv6/netfilter/Kconfig:245:config IP6_NF_RAW\nnet/ipv6/netfilter/Kconfig-246-\ttristate  'raw table support (required for TRACE)'\n"
}

gemini-3.1-pro-preview

							input: 33739
							output: 217
							thoughts: 1076

**Reasoning Through the Netfilter Configuration and Symbol Requirements**

Okay, let's break this down systematically. The initial goal is to identify the required kernel configurations and relevant symbols for a specific netfilter target, likely related to connection tracking. The prompt specifies the output format for configurations, so I need to avoid the `CONFIG_` prefix.

First, I identified the initial set of potentially needed configurations: `NETFILTER_XT_TARGET_CT`, `NF_CONNTRACK`, `IP_NF_RAW`, and `NETFILTER_ADVANCED`. The prompt's requirement is clear: just the bare names.

Now, let's dig deeper to see if any other configurations are related to `xt_CT`. Upon examination, I see the `xt_IDLETIMER.c` file is also touched in the patch, so `NETFILTER_XT_TARGET_IDLETIMER` should also be included because it's a functional change.

Next, the prompt wants symbols. The functions that seem central to the target's operation are `xt_ct_tg_check` and `idletimer_tg_checkentry`. However, the prompt emphasizes the preference for non-static, non-inlined API entry points. That gives me pause.

Upon closer inspection, I confirm that both `xt_ct_tg_check` is actually static. However, it's called by `xt_ct_tg_check_v0`, `xt_ct_tg_check_v1`, `xt_ct_tg_check_v2`. These static functions are registered in `xt_ct_tg_reg` array, which is passed to `xt_register_targets`. The entry point from userspace is `xt_check_target`, but `xt_ct_tg_check` is the specific function. Since the function is not inlined, I'll provide `xt_ct_tg_check` for now and see if the fuzzer can resolve the static functions.

The patch's functional changes involve changes to the validation logic for `info->helper` and `info->timeout` and modifying `xt_IDLETIMER.c` to release a mutex, which impacts the execution flow. These modifications are reachable via netfilter configuration, making them relevant to the overall target behavior.

Therefore, my final list is:

Configs:
`NETFILTER_XT_TARGET_CT`
`NETFILTER_XT_TARGET_IDLETIMER`
`NF_CONNTRACK`
`IP_NF_RAW`
`NETFILTER_ADVANCED`

Symbols:
`xt_ct_tg_check`

Let's proceed with these results.

{
  "EnableConfigs": [
    "NETFILTER_XT_TARGET_CT",
    "NETFILTER_XT_TARGET_IDLETIMER",
    "NF_CONNTRACK",
    "IP_NF_RAW",
    "NETFILTER_ADVANCED"
  ],
  "FocusSymbols": [
    "xt_ct_tg_check",
    "idletimer_tg_checkentry",
    "idletimer_tg_checkentry_v1"
  ],
  "Reasoning": "The patch modifies `xt_CT.c` to change the validation logic for `info-\u003ehelper` and `info-\u003etimeout`. If they are not null-terminated, the new code skips setting them instead of returning `-ENAMETOOLONG`, which is a functional change in the target initialization logic. The patch also modifies `xt_IDLETIMER.c` to release a mutex before logging, which is a minor functional change. These changes alter the execution flow and are reachable from userspace via netfilter configuration.",
  "WorthFuzzing": true
}

{
  "EnableConfigs": [
    "NETFILTER_XT_TARGET_CT",
    "NETFILTER_XT_TARGET_IDLETIMER",
    "NF_CONNTRACK",
    "IP_NF_RAW",
    "NETFILTER_ADVANCED"
  ],
  "FocusSymbols": [
    "xt_ct_tg_check",
    "idletimer_tg_checkentry",
    "idletimer_tg_checkentry_v1"
  ],
  "Reasoning": "The patch modifies `xt_CT.c` to change the validation logic for `info-\u003ehelper` and `info-\u003etimeout`. If they are not null-terminated, the new code skips setting them instead of returning `-ENAMETOOLONG`, which is a functional change in the target initialization logic. The patch also modifies `xt_IDLETIMER.c` to release a mutex before logging, which is a minor functional change. These changes alter the execution flow and are reachable from userspace via netfilter configuration.",
  "WorthFuzzing": true
}

{
  "WorthFuzzing": true
}

{
  "KMSANReasoning": "The patch series primarily removes `pr_debug` statements and converts some to `pr_info_ratelimited` across various netfilter modules. There is also a logical change in `xt_CT.c` regarding the validation of `info-\u003ehelper` and `info-\u003etimeout` strings, which introduces dead code and alters the error handling for non-null-terminated strings. However, the `info` structure (`par-\u003etarginfo`) is populated via `copy_from_user` with data provided by userspace, meaning the memory is fully initialized from the kernel's perspective. The patch does not introduce any new allocations, does not expose kernel memory to userspace, and does not add control flow dependent on uninitialized kernel memory. Any bugs introduced by this patch (such as the logic flaw in `xt_CT.c`) are functional and do not involve uninitialized memory. Therefore, a dedicated KMSAN fuzzing session is not necessary.",
  "NeedsKMSAN": false
}

You are an expert Linux kernel security engineer specializing in kernel memory
error detectors (KASAN and KMSAN). Your job is to review the provided patch series and
determine if the code changes justify spawning a dedicated KMSAN (KernelMemorySanitizer)
fuzzing session in addition to standard KASAN fuzzing.

CRITICAL DISTINCTION BETWEEN KASAN AND KMSAN:
- Standard KASAN kernel builds (upstream-apparmor-kasan.config) already enable
  a comprehensive suite of debugging tools and sanitizers, including KASAN
  (out-of-bounds accesses, use-after-free, double free, invalid free), LOCKDEP
  (locking bugs and deadlocks), UB-sanitizers, and memory corruption checks.
- KMSAN (KernelMemorySanitizer) detects reads of UNINITIALIZED memory (stack, heap,
  or page allocations) and kernel-to-user memory info-leaks.

Rule: THERE IS NO SENSE IN RUNNING A KMSAN SESSION IF A BUG CAN BE CAUGHT BY KASAN,
LOCKDEP, OR OTHER STANDARD BUG DETECTORS.
A dedicated KMSAN fuzzing session incurs significant resource costs. You must ONLY
set NeedsKMSAN=true if the code changes introduce or expose UNINITIALIZED MEMORY risks
that are detected ONLY by KMSAN.

Look holistically at the patch series and surrounding code. Even if no direct
uninitialized field accesses or new buffer allocations are added in the diff itself,
a patch may alter control flow, bounds checking, or data length calculations in ways
that change how the rest of the code operates on existing buffers (e.g. allowing
uninitialized stack/heap memory to be read, copied to user space, or used in control
flow). Do not hesitate to use your code access tools to inspect the surrounding code,
called functions, and callers.

Set NeedsKMSAN=true ONLY IF the patch introduces or modifies:
1. Kernel structures sent to user space (via copy_to_user, put_user, netlink skb
   attributes, ioctl output arguments, socket options, or BPF buffers) where fields
   or structure padding might not be fully initialized/zeroed.
2. Conditional logic or branching that depends on potentially uninitialized variables
   or struct fields.
3. Allocation or initialization of complex data structures where uninitialized fields
   could be read later in reachable code paths.
4. Bounds checks, lengths, or logic in a way that allows surrounding code to access
   uninitialized bytes of existing buffers.

Set NeedsKMSAN=false IF:
- The code changes primarily risk out-of-bounds access, array overflows, NULL pointer
  dereferences, locking deadlocks, or use-after-free bugs (these are already caught
  by KASAN, LOCKDEP, or standard bug detectors).
- All stack/heap structures touched or introduced by the patch are fully zeroed
  or initialized (e.g. using = {0}, memset, kzalloc) before being read or copied.
- The patch does not introduce any risk of uninitialized memory usage or info-leaks.

Use your code access tools to inspect the surrounding code if necessary, then provide
detailed KMSANReasoning contrasting KASAN vs KMSAN applicability for this patch.
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit 9338aec55ce1ed0fef018b0c87a6ae341b6a6a77
Author: syz-cluster <triage@syzkaller.com>
Date:   Tue Aug 18 14:39:20 2026 +0000

    syz-cluster: applied patch under review

diff --git a/net/ipv4/netfilter/ipt_ah.c b/net/ipv4/netfilter/ipt_ah.c
index 161ba412cb08b..7131f297ada2e 100644
--- a/net/ipv4/netfilter/ipt_ah.c
+++ b/net/ipv4/netfilter/ipt_ah.c
@@ -19,12 +19,7 @@ MODULE_DESCRIPTION("Xtables: IPv4 IPsec-AH SPI match");
 static inline bool
 spi_match(u_int32_t min, u_int32_t max, u_int32_t spi, bool invert)
 {
-	bool r;
-	pr_debug("spi_match:%c 0x%x <= 0x%x <= 0x%x\n",
-		 invert ? '!' : ' ', min, spi, max);
-	r = (spi >= min && spi <= max) ^ invert;
-	pr_debug(" result %s\n", r ? "PASS" : "FAILED");
-	return r;
+	return (spi >= min && spi <= max) ^ invert;
 }
 
 static bool ah_mt(const struct sk_buff *skb, struct xt_action_param *par)
@@ -42,7 +37,6 @@ static bool ah_mt(const struct sk_buff *skb, struct xt_action_param *par)
 		/* We've been asked to examine this packet, and we
 		 * can't.  Hence, no choice but to drop.
 		 */
-		pr_debug("Dropping evil AH tinygram.\n");
 		par->hotdrop = true;
 		return false;
 	}
@@ -58,7 +52,7 @@ static int ah_mt_check(const struct xt_mtchk_param *par)
 
 	/* Must specify no unknown invflags */
 	if (ahinfo->invflags & ~IPT_AH_INV_MASK) {
-		pr_debug("unknown flags %X\n", ahinfo->invflags);
+		pr_info_ratelimited("unknown flags %X\n", ahinfo->invflags);
 		return -EINVAL;
 	}
 	return 0;
diff --git a/net/ipv4/netfilter/ipt_rpfilter.c b/net/ipv4/netfilter/ipt_rpfilter.c
index 6d9bf51068684..2c38fd6624aa1 100644
--- a/net/ipv4/netfilter/ipt_rpfilter.c
+++ b/net/ipv4/netfilter/ipt_rpfilter.c
@@ -95,8 +95,7 @@ static int rpfilter_check(const struct xt_mtchk_param *par)
 
 	if (strcmp(par->table, "mangle") != 0 &&
 	    strcmp(par->table, "raw") != 0) {
-		pr_info_ratelimited("only valid in \'raw\' or \'mangle\' table, not \'%s\'\n",
-				    par->table);
+		pr_info_ratelimited("only valid in \'raw\' or \'mangle\' table\n");
 		return -EINVAL;
 	}
 
diff --git a/net/ipv6/netfilter/ip6t_ah.c b/net/ipv6/netfilter/ip6t_ah.c
index 1258783ed8762..dab7dbc6a675c 100644
--- a/net/ipv6/netfilter/ip6t_ah.c
+++ b/net/ipv6/netfilter/ip6t_ah.c
@@ -24,13 +24,7 @@ MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>");
 static inline bool
 spi_match(u_int32_t min, u_int32_t max, u_int32_t spi, bool invert)
 {
-	bool r;
-
-	pr_debug("spi_match:%c 0x%x <= 0x%x <= 0x%x\n",
-		 invert ? '!' : ' ', min, spi, max);
-	r = (spi >= min && spi <= max) ^ invert;
-	pr_debug(" result %s\n", r ? "PASS" : "FAILED");
-	return r;
+	return (spi >= min && spi <= max) ^ invert;
 }
 
 static bool ah_mt6(const struct sk_buff *skb, struct xt_action_param *par)
@@ -62,23 +56,6 @@ static bool ah_mt6(const struct sk_buff *skb, struct xt_action_param *par)
 		return false;
 	}
 
-	pr_debug("IPv6 AH LEN %u %u ", hdrlen, ah->hdrlen);
-	pr_debug("RES %04X ", ah->reserved);
-	pr_debug("SPI %u %08X\n", ntohl(ah->spi), ntohl(ah->spi));
-
-	pr_debug("IPv6 AH spi %02X ",
-		 spi_match(ahinfo->spis[0], ahinfo->spis[1],
-			   ntohl(ah->spi),
-			   !!(ahinfo->invflags & IP6T_AH_INV_SPI)));
-	pr_debug("len %02X %04X %02X ",
-		 ahinfo->hdrlen, hdrlen,
-		 (!ahinfo->hdrlen ||
-		  (ahinfo->hdrlen == hdrlen) ^
-		  !!(ahinfo->invflags & IP6T_AH_INV_LEN)));
-	pr_debug("res %02X %04X %02X\n",
-		 ahinfo->hdrres, ah->reserved,
-		 !(ahinfo->hdrres && ah->reserved));
-
 	return spi_match(ahinfo->spis[0], ahinfo->spis[1],
 			  ntohl(ah->spi),
 			  !!(ahinfo->invflags & IP6T_AH_INV_SPI)) &&
@@ -93,7 +70,7 @@ static int ah_mt6_check(const struct xt_mtchk_param *par)
 	const struct ip6t_ah *ahinfo = par->matchinfo;
 
 	if (ahinfo->invflags & ~IP6T_AH_INV_MASK) {
-		pr_debug("unknown flags %X\n", ahinfo->invflags);
+		pr_info_ratelimited("unknown flags %X\n", ahinfo->invflags);
 		return -EINVAL;
 	}
 	return 0;
diff --git a/net/ipv6/netfilter/ip6t_frag.c b/net/ipv6/netfilter/ip6t_frag.c
index 3aad6439386b1..f5f3cfb8704cf 100644
--- a/net/ipv6/netfilter/ip6t_frag.c
+++ b/net/ipv6/netfilter/ip6t_frag.c
@@ -23,12 +23,7 @@ MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>");
 static inline bool
 id_match(u_int32_t min, u_int32_t max, u_int32_t id, bool invert)
 {
-	bool r;
-	pr_debug("id_match:%c 0x%x <= 0x%x <= 0x%x\n", invert ? '!' : ' ',
-		 min, id, max);
-	r = (id >= min && id <= max) ^ invert;
-	pr_debug(" result %s\n", r ? "PASS" : "FAILED");
-	return r;
+	return (id >= min && id <= max) ^ invert;
 }
 
 static bool
@@ -53,38 +48,6 @@ frag_mt6(const struct sk_buff *skb, struct xt_action_param *par)
 		return false;
 	}
 
-	pr_debug("INFO %04X ", fh->frag_off);
-	pr_debug("OFFSET %04X ", ntohs(fh->frag_off) & ~0x7);
-	pr_debug("RES %02X %04X", fh->reserved, ntohs(fh->frag_off) & 0x6);
-	pr_debug("MF %04X ", fh->frag_off & htons(IP6_MF));
-	pr_debug("ID %u %08X\n", ntohl(fh->identification),
-		 ntohl(fh->identification));
-
-	pr_debug("IPv6 FRAG id %02X ",
-		 id_match(fraginfo->ids[0], fraginfo->ids[1],
-			  ntohl(fh->identification),
-			  !!(fraginfo->invflags & IP6T_FRAG_INV_IDS)));
-	pr_debug("res %02X %02X%04X %02X ",
-		 fraginfo->flags & IP6T_FRAG_RES, fh->reserved,
-		 ntohs(fh->frag_off) & 0x6,
-		 !((fraginfo->flags & IP6T_FRAG_RES) &&
-		   (fh->reserved || (ntohs(fh->frag_off) & 0x06))));
-	pr_debug("first %02X %02X %02X ",
-		 fraginfo->flags & IP6T_FRAG_FST,
-		 ntohs(fh->frag_off) & ~0x7,
-		 !((fraginfo->flags & IP6T_FRAG_FST) &&
-		   (ntohs(fh->frag_off) & ~0x7)));
-	pr_debug("mf %02X %02X %02X ",
-		 fraginfo->flags & IP6T_FRAG_MF,
-		 ntohs(fh->frag_off) & IP6_MF,
-		 !((fraginfo->flags & IP6T_FRAG_MF) &&
-		   !((ntohs(fh->frag_off) & IP6_MF))));
-	pr_debug("last %02X %02X %02X\n",
-		 fraginfo->flags & IP6T_FRAG_NMF,
-		 ntohs(fh->frag_off) & IP6_MF,
-		 !((fraginfo->flags & IP6T_FRAG_NMF) &&
-		   (ntohs(fh->frag_off) & IP6_MF)));
-
 	return id_match(fraginfo->ids[0], fraginfo->ids[1],
 			 ntohl(fh->identification),
 			 !!(fraginfo->invflags & IP6T_FRAG_INV_IDS)) &&
@@ -103,7 +66,7 @@ static int frag_mt6_check(const struct xt_mtchk_param *par)
 	const struct ip6t_frag *fraginfo = par->matchinfo;
 
 	if (fraginfo->invflags & ~IP6T_FRAG_INV_MASK) {
-		pr_debug("unknown flags %X\n", fraginfo->invflags);
+		pr_info_ratelimited("unknown flags %X\n", fraginfo->invflags);
 		return -EINVAL;
 	}
 	return 0;
diff --git a/net/ipv6/netfilter/ip6t_hbh.c b/net/ipv6/netfilter/ip6t_hbh.c
index 6d1a5d2026a67..37c207d3152a4 100644
--- a/net/ipv6/netfilter/ip6t_hbh.c
+++ b/net/ipv6/netfilter/ip6t_hbh.c
@@ -79,14 +79,6 @@ hbh_mt6(const struct sk_buff *skb, struct xt_action_param *par)
 		return false;
 	}
 
-	pr_debug("IPv6 OPTS LEN %u %u ", hdrlen, oh->hdrlen);
-
-	pr_debug("len %02X %04X %02X ",
-		 optinfo->hdrlen, hdrlen,
-		 (!(optinfo->flags & IP6T_OPTS_LEN) ||
-		  ((optinfo->hdrlen == hdrlen) ^
-		   !!(optinfo->invflags & IP6T_OPTS_INV_LEN))));
-
 	ret = (!(optinfo->flags & IP6T_OPTS_LEN) ||
 	       ((optinfo->hdrlen == hdrlen) ^
 		!!(optinfo->invflags & IP6T_OPTS_INV_LEN)));
@@ -96,8 +88,6 @@ hbh_mt6(const struct sk_buff *skb, struct xt_action_param *par)
 	if (!(optinfo->flags & IP6T_OPTS_OPTS)) {
 		return ret;
 	} else {
-		pr_debug("Strict ");
-		pr_debug("#%d ", optinfo->optsnr);
 		for (temp = 0; temp < optinfo->optsnr; temp++) {
 			/* type field exists ? */
 			if (hdrlen < 1)
@@ -108,13 +98,9 @@ hbh_mt6(const struct sk_buff *skb, struct xt_action_param *par)
 				break;
 
 			/* Type check */
-			if (*tp != (optinfo->opts[temp] & 0xFF00) >> 8) {
-				pr_debug("Tbad %02X %02X\n", *tp,
-					 (optinfo->opts[temp] & 0xFF00) >> 8);
+			if (*tp != (optinfo->opts[temp] & 0xFF00) >> 8)
 				return false;
-			} else {
-				pr_debug("Tok ");
-			}
+
 			/* Length check */
 			if (*tp) {
 				u16 spec_len;
@@ -129,26 +115,18 @@ hbh_mt6(const struct sk_buff *skb, struct xt_action_param *par)
 					break;
 				spec_len = optinfo->opts[temp] & 0x00FF;
 
-				if (spec_len != 0x00FF && spec_len != *lp) {
-					pr_debug("Lbad %02X %04X\n", *lp,
-						 spec_len);
+				if (spec_len != 0x00FF && spec_len != *lp)
 					return false;
-				}
-				pr_debug("Lok ");
+
 				optlen = *lp + 2;
 			} else {
-				pr_debug("Pad1\n");
 				optlen = 1;
 			}
 
-			/* Step to the next */
-			pr_debug("len%04X\n", optlen);
-
 			if ((ptr > skb->len - optlen || hdrlen < optlen) &&
-			    temp < optinfo->optsnr - 1) {
-				pr_debug("new pointer is too large!\n");
+			    temp < optinfo->optsnr - 1)
 				break;
-			}
+
 			ptr += optlen;
 			hdrlen -= optlen;
 		}
@@ -166,16 +144,16 @@ static int hbh_mt6_check(const struct xt_mtchk_param *par)
 	const struct ip6t_opts *optsinfo = par->matchinfo;
 
 	if (optsinfo->invflags & ~IP6T_OPTS_INV_MASK) {
-		pr_debug("unknown flags %X\n", optsinfo->invflags);
+		pr_info_ratelimited("unknown flags %X\n", optsinfo->invflags);
 		return -EINVAL;
 	}
 	if (optsinfo->optsnr > IP6T_OPTS_OPTSNR) {
-		pr_debug("too many supported opts specified\n");
+		pr_info_ratelimited("too many supported opts specified\n");
 		return -EINVAL;
 	}
 
 	if (optsinfo->flags & IP6T_OPTS_NSTRICT) {
-		pr_debug("Not strict - not implemented");
+		pr_info_ratelimited("Not strict - not implemented");
 		return -EINVAL;
 	}
 
diff --git a/net/ipv6/netfilter/ip6t_mh.c b/net/ipv6/netfilter/ip6t_mh.c
index fd492b69acbc0..ba6dcc7791a09 100644
--- a/net/ipv6/netfilter/ip6t_mh.c
+++ b/net/ipv6/netfilter/ip6t_mh.c
@@ -42,14 +42,11 @@ static bool mh_mt6(const struct sk_buff *skb, struct xt_action_param *par)
 	if (mh == NULL) {
 		/* We've been asked to examine this packet, and we
 		   can't.  Hence, no choice but to drop. */
-		pr_debug("Dropping evil MH tinygram.\n");
 		par->hotdrop = true;
 		return false;
 	}
 
 	if (mh->ip6mh_proto != IPPROTO_NONE) {
-		pr_debug("Dropping invalid MH Payload Proto: %u\n",
-			 mh->ip6mh_proto);
 		par->hotdrop = true;
 		return false;
 	}
diff --git a/net/ipv6/netfilter/ip6t_rpfilter.c b/net/ipv6/netfilter/ip6t_rpfilter.c
index 67c87a88cde4f..af8d10d49de81 100644
--- a/net/ipv6/netfilter/ip6t_rpfilter.c
+++ b/net/ipv6/netfilter/ip6t_rpfilter.c
@@ -118,7 +118,7 @@ static int rpfilter_check(const struct xt_mtchk_param *par)
 
 	if (strcmp(par->table, "mangle") != 0 &&
 	    strcmp(par->table, "raw") != 0) {
-		pr_info_ratelimited("only valid in \'raw\' or \'mangle\' table, not \'%s\'\n",
+		pr_info_ratelimited("only valid in \'raw\' or \'mangle\' table\n",
 				    par->table);
 		return -EINVAL;
 	}
diff --git a/net/ipv6/netfilter/ip6t_rt.c b/net/ipv6/netfilter/ip6t_rt.c
index 278b52752f364..0c01ac2746d1f 100644
--- a/net/ipv6/netfilter/ip6t_rt.c
+++ b/net/ipv6/netfilter/ip6t_rt.c
@@ -155,18 +155,18 @@ static int rt_mt6_check(const struct xt_mtchk_param *par)
 	const struct ip6t_rt *rtinfo = par->matchinfo;
 
 	if (rtinfo->invflags & ~IP6T_RT_INV_MASK) {
-		pr_debug("unknown flags %X\n", rtinfo->invflags);
+		pr_info_ratelimited("unknown flags %X\n", rtinfo->invflags);
 		return -EINVAL;
 	}
 	if (rtinfo->addrnr > IP6T_RT_HOPS) {
-		pr_debug("too many addresses specified\n");
+		pr_info_ratelimited("too many addresses specified\n");
 		return -EINVAL;
 	}
 	if ((rtinfo->flags & (IP6T_RT_RES | IP6T_RT_FST_MASK)) &&
 	    (!(rtinfo->flags & IP6T_RT_TYP) ||
 	     (rtinfo->rt_type != 0) ||
 	     (rtinfo->invflags & IP6T_RT_INV_TYP))) {
-		pr_debug("`--rt-type 0' required before `--rt-0-*'");
+		pr_info_ratelimited("`--rt-type 0' required before `--rt-0-*'");
 		return -EINVAL;
 	}
 
diff --git a/net/netfilter/xt_CONNSECMARK.c b/net/netfilter/xt_CONNSECMARK.c
index 1494b3ee30e11..4e4436a9104b4 100644
--- a/net/netfilter/xt_CONNSECMARK.c
+++ b/net/netfilter/xt_CONNSECMARK.c
@@ -87,8 +87,7 @@ static int connsecmark_tg_check(const struct xt_tgchk_param *par)
 
 	if (strcmp(par->table, "mangle") != 0 &&
 	    strcmp(par->table, "security") != 0) {
-		pr_info_ratelimited("only valid in \'mangle\' or \'security\' table, not \'%s\'\n",
-				    par->table);
+		pr_info_ratelimited("only valid in \'mangle\' or \'security\' table\n");
 		return -EINVAL;
 	}
 
diff --git a/net/netfilter/xt_CT.c b/net/netfilter/xt_CT.c
index e78660dfdf4b6..91326014ade1c 100644
--- a/net/netfilter/xt_CT.c
+++ b/net/netfilter/xt_CT.c
@@ -195,7 +195,8 @@ static int xt_ct_tg_check(const struct xt_tgchk_param *par,
 		goto err3;
 	}
 
-	if (info->helper[0]) {
+	if (info->helper[0] &&
+	    strnlen(info->helper, sizeof(info->helper)) < sizeof(info->helper)) {
 		if (strnlen(info->helper, sizeof(info->helper)) == sizeof(info->helper)) {
 			ret = -ENAMETOOLONG;
 			goto err3;
@@ -206,7 +207,8 @@ static int xt_ct_tg_check(const struct xt_tgchk_param *par,
 			goto err3;
 	}
 
-	if (info->timeout[0]) {
+	if (info->timeout[0] &&
+	    strnlen(info->timeout, sizeof(info->timeout)) < sizeof(info->timeout)) {
 		if (strnlen(info->timeout, sizeof(info->timeout)) == sizeof(info->timeout)) {
 			ret = -ENAMETOOLONG;
 			goto err4;
diff --git a/net/netfilter/xt_IDLETIMER.c b/net/netfilter/xt_IDLETIMER.c
index bfcf2d44e93db..15b698ea98aa6 100644
--- a/net/netfilter/xt_IDLETIMER.c
+++ b/net/netfilter/xt_IDLETIMER.c
@@ -102,8 +102,6 @@ static void idletimer_tg_expired(struct timer_list *t)
 {
 	struct idletimer_tg *timer = timer_container_of(timer, t, timer);
 
-	pr_debug("timer %s expired\n", timer->attr.attr.name);
-
 	schedule_work(&timer->work);
 }
 
@@ -111,7 +109,6 @@ static void idletimer_tg_alarmproc(struct alarm *alarm, ktime_t now)
 {
 	struct idletimer_tg *timer = alarm->data;
 
-	pr_debug("alarm %s expired\n", timer->attr.attr.name);
 	schedule_work(&timer->work);
 }
 
@@ -171,7 +168,7 @@ static int idletimer_tg_create(struct idletimer_tg_info *info)
 
 	ret = sysfs_create_file(idletimer_tg_kobj, &info->timer->attr.attr);
 	if (ret < 0) {
-		pr_debug("couldn't add file to sysfs");
+		pr_info_ratelimited("couldn't add file to sysfs");
 		goto out_free_attr;
 	}
 
@@ -220,7 +217,7 @@ static int idletimer_tg_create_v1(struct idletimer_tg_info_v1 *info)
 
 	ret = sysfs_create_file(idletimer_tg_kobj, &info->timer->attr.attr);
 	if (ret < 0) {
-		pr_debug("couldn't add file to sysfs");
+		pr_info_ratelimited("couldn't add file to sysfs");
 		goto out_free_attr;
 	}
 
@@ -228,7 +225,6 @@ static int idletimer_tg_create_v1(struct idletimer_tg_info_v1 *info)
 	kobject_uevent(idletimer_tg_kobj,KOBJ_ADD);
 
 	list_add(&info->timer->entry, &idletimer_tg_list);
-	pr_debug("timer type value is %u", info->timer_type);
 	info->timer->timer_type = info->timer_type;
 	info->timer->refcnt = 1;
 
@@ -263,9 +259,6 @@ static unsigned int idletimer_tg_target(struct sk_buff *skb,
 {
 	const struct idletimer_tg_info *info = par->targinfo;
 
-	pr_debug("resetting timer %s, timeout period %u\n",
-		 info->label, info->timeout);
-
 	mod_timer(&info->timer->timer,
 		  secs_to_jiffies(info->timeout) + jiffies);
 
@@ -280,9 +273,6 @@ static unsigned int idletimer_tg_target_v1(struct sk_buff *skb,
 {
 	const struct idletimer_tg_info_v1 *info = par->targinfo;
 
-	pr_debug("resetting timer %s, timeout period %u\n",
-		 info->label, info->timeout);
-
 	if (info->timer->timer_type & XT_IDLETIMER_ALARM) {
 		idletimer_start_alarm_sec(info->timer, info->timeout);
 	} else {
@@ -296,17 +286,17 @@ static unsigned int idletimer_tg_target_v1(struct sk_buff *skb,
 static int idletimer_tg_helper(struct idletimer_tg_info *info)
 {
 	if (info->timeout == 0) {
-		pr_debug("timeout value is zero\n");
+		pr_info_ratelimited("timeout value is zero\n");
 		return -EINVAL;
 	}
 	if (info->timeout >= INT_MAX / 1000) {
-		pr_debug("timeout value is too big\n");
+		pr_info_ratelimited("timeout value is too big\n");
 		return -EINVAL;
 	}
 	if (info->label[0] == '\0' ||
 	    strnlen(info->label,
 		    MAX_IDLETIMER_LABEL_SIZE) == MAX_IDLETIMER_LABEL_SIZE) {
-		pr_debug("label is empty or not nul-terminated\n");
+		pr_info_ratelimited("label is empty or not nul-terminated\n");
 		return -EINVAL;
 	}
 	return 0;
@@ -318,34 +308,25 @@ static int idletimer_tg_checkentry(const struct xt_tgchk_param *par)
 	struct idletimer_tg_info *info = par->targinfo;
 	int ret;
 
-	pr_debug("checkentry targinfo%s\n", info->label);
-
 	ret = idletimer_tg_helper(info);
 	if(ret < 0)
-	{
-		pr_debug("checkentry helper return invalid\n");
 		return -EINVAL;
-	}
 	mutex_lock(&list_mutex);
 
 	info->timer = __idletimer_tg_find_by_label(info->label);
 	if (info->timer) {
 		if (info->timer->timer_type & XT_IDLETIMER_ALARM) {
-			pr_debug("Adding/Replacing rule with same label and different timer type is not allowed\n");
 			mutex_unlock(&list_mutex);
+			pr_info_ratelimited("Adding/Replacing rule with same label and different timer type is not allowed\n");
 			return -EINVAL;
 		}
 
 		info->timer->refcnt++;
 		mod_timer(&info->timer->timer,
 			  secs_to_jiffies(info->timeout) + jiffies);
-
-		pr_debug("increased refcnt of timer %s to %u\n",
-			 info->label, info->timer->refcnt);
 	} else {
 		ret = idletimer_tg_create(info);
 		if (ret < 0) {
-			pr_debug("failed to create timer\n");
 			mutex_unlock(&list_mutex);
 			return ret;
 		}
@@ -360,30 +341,23 @@ static int idletimer_tg_checkentry_v1(const struct xt_tgchk_param *par)
 	struct idletimer_tg_info_v1 *info = par->targinfo;
 	int ret;
 
-	pr_debug("checkentry targinfo%s\n", info->label);
-
 	if (info->send_nl_msg)
 		return -EOPNOTSUPP;
 
 	ret = idletimer_tg_helper((struct idletimer_tg_info *)info);
 	if(ret < 0)
-	{
-		pr_debug("checkentry helper return invalid\n");
 		return -EINVAL;
-	}
 
-	if (info->timer_type > XT_IDLETIMER_ALARM) {
-		pr_debug("invalid value for timer type\n");
+	if (info->timer_type > XT_IDLETIMER_ALARM)
 		return -EINVAL;
-	}
 
 	mutex_lock(&list_mutex);
 
 	info->timer = __idletimer_tg_find_by_label(info->label);
 	if (info->timer) {
 		if (info->timer->timer_type != info->timer_type) {
-			pr_debug("Adding/Replacing rule with same label and different timer type is not allowed\n");
 			mutex_unlock(&list_mutex);
+			pr_info_ratelimited("Adding/Replacing rule with same label and different timer type is not allowed\n");
 			return -EINVAL;
 		}
 
@@ -393,21 +367,15 @@ static int idletimer_tg_checkentry_v1(const struct xt_tgchk_param *par)
 			ktime_t tout = alarm_expires_remaining(&info->timer->alarm);
 			struct timespec64 ktimespec = ktime_to_timespec64(tout);
 
-			if (ktimespec.tv_sec > 0) {
-				pr_debug("time_expiry_remaining %lld\n",
-					 ktimespec.tv_sec);
+			if (ktimespec.tv_sec > 0)
 				idletimer_start_alarm_ktime(info->timer, tout);
-			}
 		} else {
 				mod_timer(&info->timer->timer,
 					secs_to_jiffies(info->timeout) + jiffies);
 		}
-		pr_debug("increased refcnt of timer %s to %u\n",
-			 info->label, info->timer->refcnt);
 	} else {
 		ret = idletimer_tg_create_v1(info);
 		if (ret < 0) {
-			pr_debug("failed to create timer\n");
 			mutex_unlock(&list_mutex);
 			return ret;
 		}
@@ -421,19 +389,13 @@ static void idletimer_tg_destroy(const struct xt_tgdtor_param *par)
 {
 	const struct idletimer_tg_info *info = par->targinfo;
 
-	pr_debug("destroy targinfo %s\n", info->label);
-
 	mutex_lock(&list_mutex);
 
 	if (--info->timer->refcnt > 0) {
-		pr_debug("decreased refcnt of timer %s to %u\n",
-			 info->label, info->timer->refcnt);
 		mutex_unlock(&list_mutex);
 		return;
 	}
 
-	pr_debug("deleting timer %s\n", info->label);
-
 	list_del(&info->timer->entry);
 	mutex_unlock(&list_mutex);
 
@@ -448,19 +410,13 @@ static void idletimer_tg_destroy_v1(const struct xt_tgdtor_param *par)
 {
 	const struct idletimer_tg_info_v1 *info = par->targinfo;
 
-	pr_debug("destroy targinfo %s\n", info->label);
-
 	mutex_lock(&list_mutex);
 
 	if (--info->timer->refcnt > 0) {
-		pr_debug("decreased refcnt of timer %s to %u\n",
-			 info->label, info->timer->refcnt);
 		mutex_unlock(&list_mutex);
 		return;
 	}
 
-	pr_debug("deleting timer %s\n", info->label);
-
 	list_del(&info->timer->entry);
 	mutex_unlock(&list_mutex);
 
@@ -534,7 +490,7 @@ static int __init idletimer_tg_init(void)
 	idletimer_tg_class = class_create("xt_idletimer");
 	err = PTR_ERR(idletimer_tg_class);
 	if (IS_ERR(idletimer_tg_class)) {
-		pr_debug("couldn't register device class\n");
+		pr_info_ratelimited("couldn't register device class\n");
 		goto out;
 	}
 
@@ -542,7 +498,7 @@ static int __init idletimer_tg_init(void)
 					    MKDEV(0, 0), NULL, "timers");
 	err = PTR_ERR(idletimer_tg_device);
 	if (IS_ERR(idletimer_tg_device)) {
-		pr_debug("couldn't register system device\n");
+		pr_info_ratelimited("couldn't register system device\n");
 		goto out_class;
 	}
 
@@ -551,7 +507,7 @@ static int __init idletimer_tg_init(void)
 	err = xt_register_targets(idletimer_tg, ARRAY_SIZE(idletimer_tg));
 
 	if (err < 0) {
-		pr_debug("couldn't register xt target\n");
+		pr_info_ratelimited("couldn't register xt target\n");
 		goto out_dev;
 	}
 
diff --git a/net/netfilter/xt_LOG.c b/net/netfilter/xt_LOG.c
index f39244f9c0ed9..de3f176792a07 100644
--- a/net/netfilter/xt_LOG.c
+++ b/net/netfilter/xt_LOG.c
@@ -50,12 +50,12 @@ static int log_tg_check(const struct xt_tgchk_param *par)
 		return -EINVAL;
 
 	if (loginfo->level >= 8) {
-		pr_debug("level %u >= 8\n", loginfo->level);
+		pr_info_ratelimited("level %u >= 8\n", loginfo->level);
 		return -EINVAL;
 	}
 
 	if (loginfo->prefix[sizeof(loginfo->prefix)-1] != '\0') {
-		pr_debug("prefix is not null-terminated\n");
+		pr_info_ratelimited("prefix is not null-terminated\n");
 		return -EINVAL;
 	}
 
diff --git a/net/netfilter/xt_MASQUERADE.c b/net/netfilter/xt_MASQUERADE.c
index eae05c1783367..cea488cec5445 100644
--- a/net/netfilter/xt_MASQUERADE.c
+++ b/net/netfilter/xt_MASQUERADE.c
@@ -21,11 +21,11 @@ static int masquerade_tg_check(const struct xt_tgchk_param *par)
 	const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;
 
 	if (mr->range[0].flags & NF_NAT_RANGE_MAP_IPS) {
-		pr_debug("bad MAP_IPS.\n");
+		pr_info_ratelimited("bad MAP_IPS.\n");
 		return -EINVAL;
 	}
 	if (mr->rangesize != 1) {
-		pr_debug("bad rangesize %u\n", mr->rangesize);
+		pr_info_ratelimited("bad rangesize %u\n", mr->rangesize);
 		return -EINVAL;
 	}
 	return nf_ct_netns_get(par->net, par->family);
diff --git a/net/netfilter/xt_NETMAP.c b/net/netfilter/xt_NETMAP.c
index cb2ee80d84fa8..8c86d9a43373a 100644
--- a/net/netfilter/xt_NETMAP.c
+++ b/net/netfilter/xt_NETMAP.c
@@ -106,11 +106,11 @@ static int netmap_tg4_check(const struct xt_tgchk_param *par)
 	const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;
 
 	if (!(mr->range[0].flags & NF_NAT_RANGE_MAP_IPS)) {
-		pr_debug("bad MAP_IPS.\n");
+		pr_info_ratelimited("bad MAP_IPS.\n");
 		return -EINVAL;
 	}
 	if (mr->rangesize != 1) {
-		pr_debug("bad rangesize %u.\n", mr->rangesize);
+		pr_info_ratelimited("bad rangesize %u.\n", mr->rangesize);
 		return -EINVAL;
 	}
 	return nf_ct_netns_get(par->net, par->family);
diff --git a/net/netfilter/xt_REDIRECT.c b/net/netfilter/xt_REDIRECT.c
index ff66b56a3f97d..27bc0545c4f74 100644
--- a/net/netfilter/xt_REDIRECT.c
+++ b/net/netfilter/xt_REDIRECT.c
@@ -51,11 +51,11 @@ static int redirect_tg4_check(const struct xt_tgchk_param *par)
 	const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;
 
 	if (mr->range[0].flags & NF_NAT_RANGE_MAP_IPS) {
-		pr_debug("bad MAP_IPS.\n");
+		pr_info_ratelimited("bad MAP_IPS.\n");
 		return -EINVAL;
 	}
 	if (mr->rangesize != 1) {
-		pr_debug("bad rangesize %u.\n", mr->rangesize);
+		pr_info_ratelimited("bad rangesize %u.\n", mr->rangesize);
 		return -EINVAL;
 	}
 	return nf_ct_netns_get(par->net, par->family);
diff --git a/net/netfilter/xt_SECMARK.c b/net/netfilter/xt_SECMARK.c
index 5bc5ea505eb9e..38e8e410b4e81 100644
--- a/net/netfilter/xt_SECMARK.c
+++ b/net/netfilter/xt_SECMARK.c
@@ -79,8 +79,7 @@ secmark_tg_check(const char *table, struct xt_secmark_target_info_v1 *info)
 
 	if (strcmp(table, "mangle") != 0 &&
 	    strcmp(table, "security") != 0) {
-		pr_info_ratelimited("only valid in \'mangle\' or \'security\' table, not \'%s\'\n",
-				    table);
+		pr_info_ratelimited("only valid in \'mangle\' or \'security\' table\n");
 		return -EINVAL;
 	}
 
diff --git a/net/netfilter/xt_cgroup.c b/net/netfilter/xt_cgroup.c
index 43d2ae2be628d..ac1b7e71cd7f5 100644
--- a/net/netfilter/xt_cgroup.c
+++ b/net/netfilter/xt_cgroup.c
@@ -33,7 +33,7 @@ static int cgroup_mt_check_v0(const struct xt_mtchk_param *par)
 		return -EINVAL;
 
 	if (!IS_ENABLED(CONFIG_CGROUP_NET_CLASSID)) {
-		pr_info(NET_CLS_CLASSID_INVALID_MSG);
+		pr_info_ratelimited(NET_CLS_CLASSID_INVALID_MSG);
 		return -EINVAL;
 	}
 
@@ -49,7 +49,7 @@ static int cgroup_mt_check_v1(const struct xt_mtchk_param *par)
 		return -EINVAL;
 
 	if (!info->has_path && !info->has_classid) {
-		pr_info("xt_cgroup: no path or classid specified\n");
+		pr_info_ratelimited("xt_cgroup: no path or classid specified\n");
 		return -EINVAL;
 	}
 
@@ -59,7 +59,7 @@ static int cgroup_mt_check_v1(const struct xt_mtchk_param *par)
 	}
 
 	if (info->has_classid && !IS_ENABLED(CONFIG_CGROUP_NET_CLASSID)) {
-		pr_info(NET_CLS_CLASSID_INVALID_MSG);
+		pr_info_ratelimited(NET_CLS_CLASSID_INVALID_MSG);
 		return -EINVAL;
 	}
 
@@ -89,7 +89,7 @@ static int cgroup_mt_check_v2(const struct xt_mtchk_param *par)
 		return -EINVAL;
 
 	if (!info->has_path && !info->has_classid) {
-		pr_info("xt_cgroup: no path or classid specified\n");
+		pr_info_ratelimited("xt_cgroup: no path or classid specified\n");
 		return -EINVAL;
 	}
 
@@ -99,7 +99,7 @@ static int cgroup_mt_check_v2(const struct xt_mtchk_param *par)
 	}
 
 	if (info->has_classid && !IS_ENABLED(CONFIG_CGROUP_NET_CLASSID)) {
-		pr_info(NET_CLS_CLASSID_INVALID_MSG);
+		pr_info_ratelimited(NET_CLS_CLASSID_INVALID_MSG);
 		return -EINVAL;
 	}
 
diff --git a/net/netfilter/xt_esp.c b/net/netfilter/xt_esp.c
index 2a1c0ad0ff079..68fd75884268a 100644
--- a/net/netfilter/xt_esp.c
+++ b/net/netfilter/xt_esp.c
@@ -25,12 +25,7 @@ MODULE_ALIAS("ip6t_esp");
 static inline bool
 spi_match(u_int32_t min, u_int32_t max, u_int32_t spi, bool invert)
 {
-	bool r;
-	pr_debug("spi_match:%c 0x%x <= 0x%x <= 0x%x\n",
-		 invert ? '!' : ' ', min, spi, max);
-	r = (spi >= min && spi <= max) ^ invert;
-	pr_debug(" result %s\n", r ? "PASS" : "FAILED");
-	return r;
+	return (spi >= min && spi <= max) ^ invert;
 }
 
 static bool esp_mt(const struct sk_buff *skb, struct xt_action_param *par)
@@ -48,7 +43,6 @@ static bool esp_mt(const struct sk_buff *skb, struct xt_action_param *par)
 		/* We've been asked to examine this packet, and we
 		 * can't.  Hence, no choice but to drop.
 		 */
-		pr_debug("Dropping evil ESP tinygram.\n");
 		par->hotdrop = true;
 		return false;
 	}
@@ -62,7 +56,7 @@ static int esp_mt_check(const struct xt_mtchk_param *par)
 	const struct xt_esp *espinfo = par->matchinfo;
 
 	if (espinfo->invflags & ~XT_ESP_INV_MASK) {
-		pr_debug("unknown flags %X\n", espinfo->invflags);
+		pr_info_ratelimited("unknown flags %X\n", espinfo->invflags);
 		return -EINVAL;
 	}
 
diff --git a/net/netfilter/xt_ipcomp.c b/net/netfilter/xt_ipcomp.c
index 472da639a32e2..3299c1ea60f9e 100644
--- a/net/netfilter/xt_ipcomp.c
+++ b/net/netfilter/xt_ipcomp.c
@@ -29,12 +29,7 @@ MODULE_ALIAS("ip6t_ipcomp");
 static inline bool
 spi_match(u_int32_t min, u_int32_t max, u_int32_t spi, bool invert)
 {
-	bool r;
-	pr_debug("spi_match:%c 0x%x <= 0x%x <= 0x%x\n",
-		 invert ? '!' : ' ', min, spi, max);
-	r = (spi >= min && spi <= max) ^ invert;
-	pr_debug(" result %s\n", r ? "PASS" : "FAILED");
-	return r;
+	return (spi >= min && spi <= max) ^ invert;
 }
 
 static bool comp_mt(const struct sk_buff *skb, struct xt_action_param *par)
@@ -52,7 +47,6 @@ static bool comp_mt(const struct sk_buff *skb, struct xt_action_param *par)
 		/* We've been asked to examine this packet, and we
 		 * can't.  Hence, no choice but to drop.
 		 */
-		pr_debug("Dropping evil IPComp tinygram.\n");
 		par->hotdrop = true;
 		return false;
 	}
diff --git a/net/netfilter/xt_iprange.c b/net/netfilter/xt_iprange.c
index 0c9e014e30b49..bf61141fb7850 100644
--- a/net/netfilter/xt_iprange.c
+++ b/net/netfilter/xt_iprange.c
@@ -24,27 +24,15 @@ iprange_mt4(const struct sk_buff *skb, struct xt_action_param *par)
 		m  = ntohl(iph->saddr) < ntohl(info->src_min.ip);
 		m |= ntohl(iph->saddr) > ntohl(info->src_max.ip);
 		m ^= !!(info->flags & IPRANGE_SRC_INV);
-		if (m) {
-			pr_debug("src IP %pI4 NOT in range %s%pI4-%pI4\n",
-			         &iph->saddr,
-			         (info->flags & IPRANGE_SRC_INV) ? "(INV) " : "",
-			         &info->src_min.ip,
-			         &info->src_max.ip);
+		if (m)
 			return false;
-		}
 	}
 	if (info->flags & IPRANGE_DST) {
 		m  = ntohl(iph->daddr) < ntohl(info->dst_min.ip);
 		m |= ntohl(iph->daddr) > ntohl(info->dst_max.ip);
 		m ^= !!(info->flags & IPRANGE_DST_INV);
-		if (m) {
-			pr_debug("dst IP %pI4 NOT in range %s%pI4-%pI4\n",
-			         &iph->daddr,
-			         (info->flags & IPRANGE_DST_INV) ? "(INV) " : "",
-			         &info->dst_min.ip,
-			         &info->dst_max.ip);
+		if (m)
 			return false;
-		}
 	}
 	return true;
 }
@@ -73,27 +61,15 @@ iprange_mt6(const struct sk_buff *skb, struct xt_action_param *par)
 		m  = iprange_ipv6_lt(&iph->saddr, &info->src_min.in6);
 		m |= iprange_ipv6_lt(&info->src_max.in6, &iph->saddr);
 		m ^= !!(info->flags & IPRANGE_SRC_INV);
-		if (m) {
-			pr_debug("src IP %pI6 NOT in range %s%pI6-%pI6\n",
-				 &iph->saddr,
-				 (info->flags & IPRANGE_SRC_INV) ? "(INV) " : "",
-				 &info->src_min.in6,
-				 &info->src_max.in6);
+		if (m)
 			return false;
-		}
 	}
 	if (info->flags & IPRANGE_DST) {
 		m  = iprange_ipv6_lt(&iph->daddr, &info->dst_min.in6);
 		m |= iprange_ipv6_lt(&info->dst_max.in6, &iph->daddr);
 		m ^= !!(info->flags & IPRANGE_DST_INV);
-		if (m) {
-			pr_debug("dst IP %pI6 NOT in range %s%pI6-%pI6\n",
-				 &iph->daddr,
-				 (info->flags & IPRANGE_DST_INV) ? "(INV) " : "",
-				 &info->dst_min.in6,
-				 &info->dst_max.in6);
+		if (m)
 			return false;
-		}
 	}
 	return true;
 }
diff --git a/net/netfilter/xt_ipvs.c b/net/netfilter/xt_ipvs.c
index 253c71cc9a634..e13c0ffb73a9a 100644
--- a/net/netfilter/xt_ipvs.c
+++ b/net/netfilter/xt_ipvs.c
@@ -148,7 +148,6 @@ ipvs_mt(const struct sk_buff *skb, struct xt_action_param *par)
 out_put_cp:
 	__ip_vs_conn_put(cp);
 out:
-	pr_debug("match=%d\n", match);
 	return match;
 }
 
diff --git a/net/netfilter/xt_multiport.c b/net/netfilter/xt_multiport.c
index a1691ff405d3c..bff5f53a9befb 100644
--- a/net/netfilter/xt_multiport.c
+++ b/net/netfilter/xt_multiport.c
@@ -37,7 +37,6 @@ ports_match_v1(const struct xt_multiport_v1 *minfo,
 		if (minfo->pflags[i]) {
 			/* range port matching */
 			e = minfo->ports[++i];
-			pr_debug("src or dst matches with %d-%d?\n", s, e);
 
 			switch (minfo->flags) {
 			case XT_MULTIPORT_SOURCE:
@@ -58,8 +57,6 @@ ports_match_v1(const struct xt_multiport_v1 *minfo,
 			}
 		} else {
 			/* exact port matching */
-			pr_debug("src or dst matches with %d?\n", s);
-
 			switch (minfo->flags) {
 			case XT_MULTIPORT_SOURCE:
 				if (src == s)
@@ -97,7 +94,6 @@ multiport_mt(const struct sk_buff *skb, struct xt_action_param *par)
 		/* We've been asked to examine this packet, and we
 		 * can't.  Hence, no choice but to drop.
 		 */
-		pr_debug("Dropping evil offset=0 tinygram.\n");
 		par->hotdrop = true;
 		return false;
 	}
diff --git a/net/netfilter/xt_sctp.c b/net/netfilter/xt_sctp.c
index b46a6a5120583..d35c21d9651b0 100644
--- a/net/netfilter/xt_sctp.c
+++ b/net/netfilter/xt_sctp.c
@@ -48,30 +48,17 @@ match_packet(const struct sk_buff *skb,
 	const struct xt_sctp_flag_info *flag_info = info->flag_info;
 	int flag_count = info->flag_count;
 
-#ifdef DEBUG
-	int i = 0;
-#endif
-
 	if (chunk_match_type == SCTP_CHUNK_MATCH_ALL)
 		SCTP_CHUNKMAP_COPY(chunkmapcopy, info->chunkmap);
 
 	do {
 		sch = skb_header_pointer(skb, offset, sizeof(_sch), &_sch);
 		if (sch == NULL || sch->length == 0) {
-			pr_debug("Dropping invalid SCTP packet.\n");
 			*hotdrop = true;
 			return false;
 		}
-#ifdef DEBUG
-		pr_debug("Chunk num: %d\toffset: %d\ttype: %d\tlength: %d"
-			 "\tflags: %x\n",
-			 ++i, offset, sch->type, htons(sch->length),
-			 sch->flags);
-#endif
 		offset += SCTP_PAD4(ntohs(sch->length));
 
-		pr_debug("skb->len: %d\toffset: %d\n", skb->len, offset);
-
 		if (SCTP_CHUNKMAP_IS_SET(info->chunkmap, sch->type)) {
 			switch (chunk_match_type) {
 			case SCTP_CHUNK_MATCH_ANY:
@@ -121,18 +108,14 @@ sctp_mt(const struct sk_buff *skb, struct xt_action_param *par)
 	const struct sctphdr *sh;
 	struct sctphdr _sh;
 
-	if (par->fragoff != 0) {
-		pr_debug("Dropping non-first fragment.. FIXME\n");
+	if (par->fragoff != 0)
 		return false;
-	}
 
 	sh = skb_header_pointer(skb, par->thoff, sizeof(_sh), &_sh);
 	if (sh == NULL) {
-		pr_debug("Dropping evil TCP offset=0 tinygram.\n");
 		par->hotdrop = true;
 		return false;
 	}
-	pr_debug("spt: %d\tdpt: %d\n", ntohs(sh->source), ntohs(sh->dest));
 
 	return  SCCHECK(ntohs(sh->source) >= info->spts[0]
 			&& ntohs(sh->source) <= info->spts[1],
diff --git a/net/netfilter/xt_tcpudp.c b/net/netfilter/xt_tcpudp.c
index f76cf18f1a244..70608b8d06ab2 100644
--- a/net/netfilter/xt_tcpudp.c
+++ b/net/netfilter/xt_tcpudp.c
@@ -44,8 +44,6 @@ tcp_find_option(u_int8_t option,
 	u_int8_t _opt[60 - sizeof(struct tcphdr)];
 	unsigned int i;
 
-	pr_debug("finding option\n");
-
 	if (!optlen)
 		return invert;
 
@@ -81,10 +79,8 @@ static bool tcp_mt(const struct sk_buff *skb, struct xt_action_param *par)
 		   causes this. Its a cracker trying to break in by doing a
 		   flag overwrite to pass the direction checks.
 		*/
-		if (par->fragoff == 1) {
-			pr_debug("Dropping evil TCP offset=1 frag.\n");
+		if (par->fragoff == 1)
 			par->hotdrop = true;
-		}
 		/* Must not be a fragment. */
 		return false;
 	}
@@ -93,7 +89,6 @@ static bool tcp_mt(const struct sk_buff *skb, struct xt_action_param *par)
 	if (th == NULL) {
 		/* We've been asked to examine this packet, and we
 		   can't.  Hence, no choice but to drop. */
-		pr_debug("Dropping evil TCP offset=0 tinygram.\n");
 		par->hotdrop = true;
 		return false;
 	}
@@ -145,7 +140,6 @@ static bool udp_mt(const struct sk_buff *skb, struct xt_action_param *par)
 	if (uh == NULL) {
 		/* We've been asked to examine this packet, and we
 		   can't.  Hence, no choice but to drop. */
-		pr_debug("Dropping evil UDP tinygram.\n");
 		par->hotdrop = true;
 		return false;
 	}

gemini-3.1-pro-preview

							input: 16918
							output: 222
							thoughts: 3053

**Analysis of Netfilter Patch Series: Primarily Logging Cleanup with a Glitch**

Okay, here's the deal. I'm looking at this patch series, and the main thing it's doing is removing a bunch of `pr_debug` calls and converting some of them to `pr_info_ratelimited` calls across a bunch of netfilter modules: `ipt_ah.c`, `ipt_rpfilter.c`, `ip6t_ah.c`, etc. Basically, it's a code cleanup, which is fine. Nothing too exciting, just making things a bit less chatty.

Then I hit this odd change in `xt_CT.c`. They've messed with the code that handles the `helper` string:

```c
-	if (info->helper[0]) {
+	if (info->helper[0] &&
+	    strnlen(info->helper, sizeof(info->helper)) < sizeof(info->helper)) {
```

I see that. Adding `strnlen` condition *before* the original condition. And then there's more after:

```c
		if (strnlen(info->helper, sizeof(info->helper)) == sizeof(info->helper)) {
			ret = -ENAMETOOLONG;
			goto err3;
		}
```

Wait a second... If that `strnlen` is *less* than `sizeof`, then the inner `if` condition will *never* be true, right? Because if it's less, the string is null-terminated, so the length can't be equal to the buffer size. That inner `if` is essentially dead code now. Seems like a logic error. Original code should've returned `-ENAMETOOLONG` if the string wasn't null-terminated. But now, with the added check, that case just *gets skipped*. Is there a KMSAN issue here?

I need to confirm the code:
```c
-	if (info->helper[0]) {
+	if (info->helper[0] &&
+	    strnlen(info->helper, sizeof(info->helper)) < sizeof(info->helper)) {
 		if (strnlen(info->helper, sizeof(info->helper)) == sizeof(info->helper)) {
 			ret = -ENAMETOOLONG;
 			goto err3;
 		}
```
Yeah! If the string is not null-terminated, it just skips the whole block. It doesn't return the `-ENAMETOOLONG` as it should. This seems like a *bug* introduced by the patch, not a fix. It skips the error checking and the helper loading when the string isn't null-terminated.

Okay, is there an uninitialized memory read here? Let me check the exact diff:
```c
-	if (info->helper[0]) {
+	if (info->helper[0] &&
+	    strnlen(info->helper, sizeof(info->helper)) < sizeof(info->helper)) {
```

No, it doesn't look like it because it's still checking the first character `info->helper[0]`. So if the string isn't fully initialized from the user's side, `strnlen` will still read it to determine the length. But... the memory for `info->helper` comes from `par->targinfo`, right? That's from userspace. If `info->helper` isn't null-terminated, `strnlen` might read it.

Is `info` *fully* initialized from userspace? Let me double-check. The code uses `copy_from_user`. So, yes! Because userspace is writing to the kernel, so KMSAN should not complain, as it marks all the memory copied from userspace as initialized! So, it initializes it as far as the kernel is concerned.

Let's look at the other changes... removing `pr_debug`. Nothing to see there.

So, in summary, this patch is mostly a cleanup, removing `pr_debug` and changing some to `pr_info_ratelimited`. The `xt_CT.c` change *does* have a logic error, in that it skips error checking. It makes the inner check dead code and changes behavior for non-null-terminated strings. But it *doesn't* introduce uninitialized memory issues. `info->helper` *is* initialized because it comes from `copy_from_user`. KMSAN is not an issue here. No need for that fuzzing. The patch has a logic flaw, that's all. And it's probably functional, not a security issue

{
  "KMSANReasoning": "The patch series primarily removes `pr_debug` statements and converts some to `pr_info_ratelimited` across various netfilter modules. There is also a logical change in `xt_CT.c` regarding the validation of `info-\u003ehelper` and `info-\u003etimeout` strings, which introduces dead code and alters the error handling for non-null-terminated strings. However, the `info` structure (`par-\u003etarginfo`) is populated via `copy_from_user` with data provided by userspace, meaning the memory is fully initialized from the kernel's perspective. The patch does not introduce any new allocations, does not expose kernel memory to userspace, and does not add control flow dependent on uninitialized kernel memory. Any bugs introduced by this patch (such as the logic flaw in `xt_CT.c`) are functional and do not involve uninitialized memory. Therefore, a dedicated KMSAN fuzzing session is not necessary.",
  "NeedsKMSAN": false
}

{
  "KMSANReasoning": "The patch series primarily removes `pr_debug` statements and converts some to `pr_info_ratelimited` across various netfilter modules. There is also a logical change in `xt_CT.c` regarding the validation of `info-\u003ehelper` and `info-\u003etimeout` strings, which introduces dead code and alters the error handling for non-null-terminated strings. However, the `info` structure (`par-\u003etarginfo`) is populated via `copy_from_user` with data provided by userspace, meaning the memory is fully initialized from the kernel's perspective. The patch does not introduce any new allocations, does not expose kernel memory to userspace, and does not add control flow dependent on uninitialized kernel memory. Any bugs introduced by this patch (such as the logic flaw in `xt_CT.c`) are functional and do not involve uninitialized memory. Therefore, a dedicated KMSAN fuzzing session is not necessary.",
  "NeedsKMSAN": false
}

LLM Calls Summary:
Total Calls	Total Tokens	Avg Tokens	Total Duration (Seconds)	Avg Duration (Seconds)

Tool Calls Summary:
Total Calls	Total Duration (Seconds)	Avg Duration (Seconds)