)]}'
{
  "commit": "6d79b223ec44ada58ad37db42f539b60985a7722",
  "tree": "1f6c5345bd6cb0d3ad7aa2f0c0fc9a0c054e6cdf",
  "parents": [
    "764dcebb033764633700a036c7351a7c6350eec6"
  ],
  "author": {
    "name": "Kuniyuki Iwashima",
    "email": "kuniyu@google.com",
    "time": "Wed Sep 09 23:31:24 2026 +0000"
  },
  "committer": {
    "name": "Jakub Kicinski",
    "email": "kuba@kernel.org",
    "time": "Fri Sep 11 17:25:13 2026 -0700"
  },
  "message": "neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS.\n\nNDTPA_INTERVAL_PROBE_TIME_MS sets .type and .min but misses\n.validation_type, so no validation is applied:\n\n  # ynl --family rt-neigh --do setneightbl \\\n  --json \u0027{\"name\": \"arp_cache\", \"parms\": {\"interval-probe-time-ms\": 0}}\u0027\n\n  # ynl --family rt-neigh --dump getneightbl --output-json | \\\n  jq \u0027.[] | select(.name \u003d\u003d \"arp_cache\" and has(\"config\"))\n          | .parms[\"interval-probe-time-ms\"]\u0027\n  0\n\nMoreover, nla_get_msecs() uses msecs_to_jiffies(), and u64 is\nsilently cast to u32, so a larger value can bypass the min check:\n\n  e.g. 4294967296 \u003d\u003d 0x100000000\n\n  # ynl --family rt-neigh --do setneightbl \\\n  --json \u0027{\"name\": \"arp_cache\", \"parms\": {\"interval-probe-time-ms\": 4294967296}}\u0027\n\n  # ynl --family rt-neigh --dump getneightbl --output-json | \\\n  jq \u0027.[] | select(.name \u003d\u003d \"arp_cache\" and has(\"config\"))\n          | .parms[\"interval-probe-time-ms\"]\u0027\n  0\n\nmsecs_to_jiffies() returns MAX_JIFFY_OFFSET if the value is\nlarger than INT_MAX.  Also, INT_MAX ms overflows int NEIGH_VAR()\nwhen HZ \u003e 1000 (Alpha, MIPS), and passing a negative integer to\nqueue_delayed_work(unsigned long delay) causes sign extension,\nwhich wraps around the expiry time to the past, resulting in it\nbeing handled as 0 delay in the timer wheel.\n\nLet\u0027s use NLA_POLICY_FULL_RANGE() and limit the max to 1 day.\n\nThe same max check is applied to sysctl as well.\n\nNote that this controls the probe interval for NTF_MANAGED\nentries, so the max of 1 day is unlikely to break any\ndeployments.\n\nFixes: 211da42eaa45 (\"net, neigh: introduce interval_probe_time_ms for periodic probe\")\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20260909233143.2401847-3-kuniyu@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "0f46ef3135905d31b441dd84a3e08c7acb0f5d47",
      "old_mode": 33188,
      "old_path": "Documentation/netlink/specs/rt-neigh.yaml",
      "new_id": "c8e55c98d56497041524be1abde1d9915da94fcb",
      "new_mode": 33188,
      "new_path": "Documentation/netlink/specs/rt-neigh.yaml"
    },
    {
      "type": "modify",
      "old_id": "208f46967ee59b0c3b313aee6f617ff8c2bf802c",
      "old_mode": 33188,
      "old_path": "Documentation/networking/ip-sysctl.rst",
      "new_id": "b05829e44d8fcb5efe1a0e27569a5ffa37915e49",
      "new_mode": 33188,
      "new_path": "Documentation/networking/ip-sysctl.rst"
    },
    {
      "type": "modify",
      "old_id": "49dd7df149ef374ca1e128f736873d592c007eda",
      "old_mode": 33188,
      "old_path": "net/core/neighbour.c",
      "new_id": "0db78a0dfb5168470e3944dd6f9e37ec0f79c216",
      "new_mode": 33188,
      "new_path": "net/core/neighbour.c"
    }
  ]
}