Re: [PATCH 4/4 nf v2] netfilter: synproxy: fix possible write to stale pointer

[Florian Westphal <fw@strlen.de>]

Fernando Fernandez Mancera <fmancera@suse.de> wrote:
> On 5/25/26 2:44 PM, Fernando Fernandez Mancera wrote:
> > skb_ensure_writable() is called to guarantee that the TCP options area
> > can be safely modified when adjusting the timestamp. As it expands or
> > linearize the skb head it might reallocate the data buffer.
> > 
> > This makes the th pointer passed by the caller stale. The following
> > writes to the TCP header might be done to a stale pointer.
> > 
> > Recalculating the th pointer after skb_ensure_writable() prevents this
> > issue from happening.
> > 
> > Fixes: 48b1de4c110a ("netfilter: add SYNPROXY core/target")
> > Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
> 
> LOL. I just realized I already reviewed this at:
> 
> https://lore.kernel.org/netfilter-devel/20260522104257.2008-3-fw@strlen.de/T/#u
> 
> *facepalm* sorry for the noise, Florian could you ignore this patch but 
> consider the other 3 fixes?

I know its tiresome, but would you mind sending a new version that also
fixes up the other things pointed out by sashiko?

https://sashiko.dev/#/patchset/20260525124450.6043-1-fmancera%40suse.de

In particular, seqadj and concurrent registration.  As these bugs aren't
as severe as patch 4, I think nf-next would be fine as well.