divert: fix NULL-deref on empty listener list (wedged pf0 in gate 11); gate 11 pdivert path; runner accepts gate filter arg

module/pfsrc/divert_sock.c

@@ -95,6 +95,18 @@ pfk_divert_pkt_free(struct pfk_divert_pkt *dp)
 }
 
 /* PF engine entry points (called from the ported pf.c) */
+static struct pfk_divert_sock *
+pfk_divert_lookup(u_int16_t port)
+{
+	struct pfk_divert_sock *ds;
+
+	list_for_each_entry(ds, &pfk_divert_list, link) {
+		if (ds->port == port)
+			return ds;
+	}
+	return NULL;
+}
+
 static int
 pfk_divert_queue(struct sk_buff *skb, int dir, int type, u16 port)
 {
@@ -114,12 +126,8 @@ pfk_divert_queue(struct sk_buff *skb, int dir, int type, u16 port)
 	dp->ifindex = skb->dev ? skb->dev->ifindex : 0;
 
 	spin_lock_irqsave(&pfk_divert_lock, flags);
-	ds = NULL;
-	list_for_each_entry(ds, &pfk_divert_list, link) {
-		if (ds->port == port)
-			break;
-	}
-	if (&ds->link == &pfk_divert_list) {
+	ds = pfk_divert_lookup(port);
+	if (ds == NULL) {
 		pfk_divert_global.divs_noport++;
 		spin_unlock_irqrestore(&pfk_divert_lock, flags);
 		pr_info_ratelimited("pfk: divert port %u: no socket bound\n",

scripts/vm-run-tests.sh

@@ -42,7 +42,9 @@ pf_disable_pf0() {
 		>/dev/null 2>&1 || true
 }
 trap pf_disable_pf0 EXIT INT TERM
+ONLY="${1:-}"
 for t in "$REPO"/tests/vm/[0-9]*.sh; do
+	[ -n "$ONLY" ] && case "$t" in *"$ONLY"*) ;; *) continue ;; esac
 	[ -e "$t" ] || continue
 	name="$(basename "$t")"
 	echo "=== $name ==="

tests/vm/11-divert.sh

@@ -16,7 +16,7 @@ FAILED=0
 
 pf0 "insmod /tmp/pf.ko 2>/dev/null || insmod /opt/pf/pf.ko; true"
 pf0 '/opt/pf/pfctl -e; /opt/pf/pfctl -f /dev/null' >/dev/null
-pfput tools/out/pdivert /opt/pf/pdivert || bad "pdivert deploy"
+pfput ../../tools/out/pdivert /opt/pf/pdivert || bad "pdivert deploy"
 pf0 'chmod +x /opt/pf/pdivert' >/dev/null
 
 cat > /tmp/g11.conf <<C