[PATCH nf] netfilter: nf_conntrack_reasm: restore IPv6 nhoff after reassembly

[PATCH nf] netfilter: nf_conntrack_reasm: restore IPv6 nhoff after reassembly

[岩橋涼介]

From 8197824cf0c745a032f6deddfc19fd62302c804e Mon Sep 17 00:00:00 2001
From: Ryosuke <ryosuke@ikotaslabs.com>
Date: Sun, 1 Nov 2026 10:43:10 +0900
Subject: [PATCH nf] netfilter: nf_conntrack_reasm: restore IPv6 nhoff after
 reassembly

nf_ct_frag6_reasm() removes the fragment header and resets the transport
header, but unlike ip6_frag_reasm() it leaves IP6CB(skb)->nhoff set to
its pre-reassembly value.

Subsequent IPv6 local delivery consumes this stale next-header offset
alongside the updated transport header. As a result, the two cursors
can point to different protocol boundaries after conntrack
defragmentation, causing later processing stages to interpret a
different transport protocol than the one evaluated by conntrack and
nftables.

Restore IP6CB(skb)->nhoff from the saved pre-fragment next-header offset
after reassembly, matching ip6_frag_reasm().

Fixes: 9fb9cbb1082d ("[NETFILTER]: Add nf_conntrack subsystem.")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5
Signed-off-by: Ryosuke <ryosuke@ikotaslabs.com>
---
 net/ipv6/netfilter/nf_conntrack_reasm.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c
b/net/ipv6/netfilter/nf_conntrack_reasm.c
index 599c49b..ab06b05 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -321,6 +321,7 @@ static int nf_ct_frag6_reasm(struct frag_queue
*fq, struct sk_buff *skb,
 			     int *refs)
 {
 	void *reasm_data;
+	unsigned int nhoff;
 	int payload_len;
 	u8 ecn;

@@ -345,7 +346,8 @@ static int nf_ct_frag6_reasm(struct frag_queue
*fq, struct sk_buff *skb,

 	/* We have to remove fragment header from datagram and to relocate
 	 * header in order to calculate ICV correctly. */
-	skb_network_header(skb)[fq->nhoffset] = skb_transport_header(skb)[0];
+	nhoff = fq->nhoffset;
+	skb_network_header(skb)[nhoff] = skb_transport_header(skb)[0];
 	memmove(skb->head + sizeof(struct frag_hdr), skb->head,
 		(skb->data - skb->head) - sizeof(struct frag_hdr));
 	if (skb_mac_header_was_set(skb))
@@ -360,6 +362,7 @@ static int nf_ct_frag6_reasm(struct frag_queue
*fq, struct sk_buff *skb,
 	skb->dev = dev;
 	ipv6_hdr(skb)->payload_len = htons(payload_len);
 	ipv6_change_dsfield(ipv6_hdr(skb), 0xff, ecn);
+	IP6CB(skb)->nhoff = nhoff;
 	IP6CB(skb)->frag_max_size = sizeof(struct ipv6hdr) + fq->q.max_size;
 	IP6CB(skb)->flags |= IP6SKB_FRAGMENTED;

-- 
2.56.0

Re: [PATCH nf] netfilter: nf_conntrack_reasm: restore IPv6 nhoff after reassembly

[Greg KH]

On Sat, Oct 31, 2026 at 08:45:52PM -0500, 岩橋涼介 wrote:
> >From 8197824cf0c745a032f6deddfc19fd62302c804e Mon Sep 17 00:00:00 2001
> From: Ryosuke <ryosuke@ikotaslabs.com>
> Date: Sun, 1 Nov 2026 10:43:10 +0900
> Subject: [PATCH nf] netfilter: nf_conntrack_reasm: restore IPv6 nhoff after
>  reassembly

This doesn't all need to be here, please use 'git send-email' or b4 to
send patches.

> 
> nf_ct_frag6_reasm() removes the fragment header and resets the transport
> header, but unlike ip6_frag_reasm() it leaves IP6CB(skb)->nhoff set to
> its pre-reassembly value.
> 
> Subsequent IPv6 local delivery consumes this stale next-header offset
> alongside the updated transport header. As a result, the two cursors
> can point to different protocol boundaries after conntrack
> defragmentation, causing later processing stages to interpret a
> different transport protocol than the one evaluated by conntrack and
> nftables.
> 
> Restore IP6CB(skb)->nhoff from the saved pre-fragment next-header offset
> after reassembly, matching ip6_frag_reasm().
> 
> Fixes: 9fb9cbb1082d ("[NETFILTER]: Add nf_conntrack subsystem.")
> Cc: stable@vger.kernel.org
> Assisted-by: Codex:gpt-5
> Signed-off-by: Ryosuke <ryosuke@ikotaslabs.com>

Real name please.

> ---
>  net/ipv6/netfilter/nf_conntrack_reasm.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c
> b/net/ipv6/netfilter/nf_conntrack_reasm.c
> index 599c49b..ab06b05 100644
> --- a/net/ipv6/netfilter/nf_conntrack_reasm.c
> +++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
> @@ -321,6 +321,7 @@ static int nf_ct_frag6_reasm(struct frag_queue
> *fq, struct sk_buff *skb,

Your patch is line-wrapped and can not be applied :(

thanks,

greg k-h

[PATCH v2 nf] netfilter: nf_conntrack_reasm: restore IPv6 nhoff after reassembly

[Ryosuke Iwahashi]

nf_ct_frag6_reasm() removes the fragment header and resets the
transport header, but unlike ip6_frag_reasm() it leaves
IP6CB(skb)->nhoff set to its pre-reassembly value.

Subsequent IPv6 local delivery consumes this stale next-header offset
alongside the updated transport header. As a result, the two cursors
can point to different protocol boundaries after conntrack
defragmentation, causing later processing stages to interpret a
different transport protocol than the one evaluated by conntrack and
nftables.

Restore IP6CB(skb)->nhoff from the saved pre-fragment next-header
offset after reassembly, matching ip6_frag_reasm().

Fixes: 9fb9cbb1082d ("[NETFILTER]: Add nf_conntrack subsystem.")
Cc: stable@vger.kernel.org
Signed-off-by: Ryosuke Iwahashi <ryosuke@ikotaslabs.com>
---
v2:
- resend with git send-email formatting
- use full real name in the author and sign-off
- no code change
---
 net/ipv6/netfilter/nf_conntrack_reasm.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index be72c4346..634122055 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -321,6 +321,7 @@ static int nf_ct_frag6_reasm(struct frag_queue *fq, struct sk_buff *skb,
 			     int *refs)
 {
 	void *reasm_data;
+	unsigned int nhoff;
 	int payload_len;
 	u8 ecn;
 
@@ -345,7 +346,8 @@ static int nf_ct_frag6_reasm(struct frag_queue *fq, struct sk_buff *skb,
 
 	/* We have to remove fragment header from datagram and to relocate
 	 * header in order to calculate ICV correctly. */
-	skb_network_header(skb)[fq->nhoffset] = skb_transport_header(skb)[0];
+	nhoff = fq->nhoffset;
+	skb_network_header(skb)[nhoff] = skb_transport_header(skb)[0];
 	memmove(skb->head + sizeof(struct frag_hdr), skb->head,
 		(skb->data - skb->head) - sizeof(struct frag_hdr));
 	if (skb_mac_header_was_set(skb))
@@ -360,6 +362,7 @@ static int nf_ct_frag6_reasm(struct frag_queue *fq, struct sk_buff *skb,
 	skb->dev = dev;
 	ipv6_hdr(skb)->payload_len = htons(payload_len);
 	ipv6_change_dsfield(ipv6_hdr(skb), 0xff, ecn);
+	IP6CB(skb)->nhoff = nhoff;
 	IP6CB(skb)->frag_max_size = sizeof(struct ipv6hdr) + fq->q.max_size;
 	IP6CB(skb)->flags |= IP6SKB_FRAGMENTED;
 
-- 
2.56.0