Re: [PATCH nf] netfilter: nft_ct: fix OOB in NFT_CT_SRC/DST eval

[Jiayuan Chen <jiayuan.chen@linux.dev>]

On 5/28/26 1:43 PM, Florian Westphal wrote:
> Florian Westphal <fw@strlen.de> wrote:
>>> which makes nf_ct_l3num(ct) be 0
>> How?

Yes, it's the template ct path.  The triggering rule is e.g.:

   table ip t {
       chain pre {
           type filter hook prerouting priority raw;
           ct zone set 1
           ct original saddr 1.2.3.4 accept
       }
   }


> Wild guess:
>
> diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c
> --- a/net/netfilter/nft_ct.c
> +++ b/net/netfilter/nft_ct.c
> @@ -78,7 +78,7 @@ static void nft_ct_get_eval(const struct nft_expr *expr,
>   		break;
>   	}
>   
> -	if (ct == NULL)
> +	if (!ct || nf_ct_is_template(ct))
>   		goto err;
>   
>   	switch (priv->key) {
> diff --git a/net/netfilter/nft_ct_fast.c b/net/netfilter/nft_ct_fast.c
> --- a/net/netfilter/nft_ct_fast.c
> +++ b/net/netfilter/nft_ct_fast.c
> @@ -30,7 +30,7 @@ void nft_ct_get_fast_eval(const struct nft_expr *expr,
>   		break;
>   	}
>   
> -	if (!ct) {
> +	if (!ct || nf_ct_is_template(ct)) {
>   		regs->verdict.code = NFT_BREAK;
>   		return;
>   	}
>

It looks more general and also covers the other GET keys that would 
equally misbehave on a template.

> .... might also make sense to invert
> nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16), i.e.:
> nf_ct_l3num(ct) == NFPROTO_IPV6 ? 16 : 4);


As defense-in-depth, IIUC?