Re: [PATCH nf] netfilter: nf_conntrack_reasm: restore IPv6 nhoff after reassembly

[Greg KH <gregkh@linuxfoundation.org>]

On Sat, Oct 31, 2026 at 08:45:52PM -0500, 岩橋涼介 wrote:
> >From 8197824cf0c745a032f6deddfc19fd62302c804e Mon Sep 17 00:00:00 2001
> From: Ryosuke <ryosuke@ikotaslabs.com>
> Date: Sun, 1 Nov 2026 10:43:10 +0900
> Subject: [PATCH nf] netfilter: nf_conntrack_reasm: restore IPv6 nhoff after
>  reassembly

This doesn't all need to be here, please use 'git send-email' or b4 to
send patches.

> 
> nf_ct_frag6_reasm() removes the fragment header and resets the transport
> header, but unlike ip6_frag_reasm() it leaves IP6CB(skb)->nhoff set to
> its pre-reassembly value.
> 
> Subsequent IPv6 local delivery consumes this stale next-header offset
> alongside the updated transport header. As a result, the two cursors
> can point to different protocol boundaries after conntrack
> defragmentation, causing later processing stages to interpret a
> different transport protocol than the one evaluated by conntrack and
> nftables.
> 
> Restore IP6CB(skb)->nhoff from the saved pre-fragment next-header offset
> after reassembly, matching ip6_frag_reasm().
> 
> Fixes: 9fb9cbb1082d ("[NETFILTER]: Add nf_conntrack subsystem.")
> Cc: stable@vger.kernel.org
> Assisted-by: Codex:gpt-5
> Signed-off-by: Ryosuke <ryosuke@ikotaslabs.com>

Real name please.

> ---
>  net/ipv6/netfilter/nf_conntrack_reasm.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c
> b/net/ipv6/netfilter/nf_conntrack_reasm.c
> index 599c49b..ab06b05 100644
> --- a/net/ipv6/netfilter/nf_conntrack_reasm.c
> +++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
> @@ -321,6 +321,7 @@ static int nf_ct_frag6_reasm(struct frag_queue
> *fq, struct sk_buff *skb,

Your patch is line-wrapped and can not be applied :(

thanks,

greg k-h