From da1f67812528837202222253a6683b5ae84d43f1 Mon Sep 17 00:00:00 2001
From: lgcosta <me@luizgustavo.pro.br>
Date: Wed, 11 Nov 2026 19:15:48 -0300
Subject: [PATCH] divert: fix NULL-deref on empty listener list (wedged pf0 in
 gate 11); gate 11 pdivert path; runner accepts gate filter arg

---
 module/pfsrc/divert_sock.c | 20 ++++++++++++++------
 scripts/vm-run-tests.sh    |  2 ++
 tests/vm/11-divert.sh      |  2 +-
 3 files changed, 17 insertions(+), 7 deletions(-)

diff --git a/module/pfsrc/divert_sock.c b/module/pfsrc/divert_sock.c
index 1e19d43..86495e9 100644
--- a/module/pfsrc/divert_sock.c
+++ b/module/pfsrc/divert_sock.c
@@ -95,6 +95,18 @@ pfk_divert_pkt_free(struct pfk_divert_pkt *dp)
 }
 
 /* PF engine entry points (called from the ported pf.c) */
+static struct pfk_divert_sock *
+pfk_divert_lookup(u_int16_t port)
+{
+	struct pfk_divert_sock *ds;
+
+	list_for_each_entry(ds, &pfk_divert_list, link) {
+		if (ds->port == port)
+			return ds;
+	}
+	return NULL;
+}
+
 static int
 pfk_divert_queue(struct sk_buff *skb, int dir, int type, u16 port)
 {
@@ -114,12 +126,8 @@ pfk_divert_queue(struct sk_buff *skb, int dir, int type, u16 port)
 	dp->ifindex = skb->dev ? skb->dev->ifindex : 0;
 
 	spin_lock_irqsave(&pfk_divert_lock, flags);
-	ds = NULL;
-	list_for_each_entry(ds, &pfk_divert_list, link) {
-		if (ds->port == port)
-			break;
-	}
-	if (&ds->link == &pfk_divert_list) {
+	ds = pfk_divert_lookup(port);
+	if (ds == NULL) {
 		pfk_divert_global.divs_noport++;
 		spin_unlock_irqrestore(&pfk_divert_lock, flags);
 		pr_info_ratelimited("pfk: divert port %u: no socket bound\n",
diff --git a/scripts/vm-run-tests.sh b/scripts/vm-run-tests.sh
index 70e6c1a..052f12d 100755
--- a/scripts/vm-run-tests.sh
+++ b/scripts/vm-run-tests.sh
@@ -42,7 +42,9 @@ pf_disable_pf0() {
 		>/dev/null 2>&1 || true
 }
 trap pf_disable_pf0 EXIT INT TERM
+ONLY="${1:-}"
 for t in "$REPO"/tests/vm/[0-9]*.sh; do
+	[ -n "$ONLY" ] && case "$t" in *"$ONLY"*) ;; *) continue ;; esac
 	[ -e "$t" ] || continue
 	name="$(basename "$t")"
 	echo "=== $name ==="
diff --git a/tests/vm/11-divert.sh b/tests/vm/11-divert.sh
index f86e6e6..2bb3b2b 100755
--- a/tests/vm/11-divert.sh
+++ b/tests/vm/11-divert.sh
@@ -16,7 +16,7 @@ FAILED=0
 
 pf0 "insmod /tmp/pf.ko 2>/dev/null || insmod /opt/pf/pf.ko; true"
 pf0 '/opt/pf/pfctl -e; /opt/pf/pfctl -f /dev/null' >/dev/null
-pfput tools/out/pdivert /opt/pf/pdivert || bad "pdivert deploy"
+pfput ../../tools/out/pdivert /opt/pf/pdivert || bad "pdivert deploy"
 pf0 'chmod +x /opt/pf/pdivert' >/dev/null
 
 cat > /tmp/g11.conf <<C