Re: [PATCH] netfilter: nf_conntrack: prevent helper extension relocation

[Pablo Neira Ayuso]

On Fri, Jul 31, 2026 at 02:08:10PM +0000, David Lee wrote:
> struct nf_conn_help contains the head of the per-master expectation
> list. hlist_add_head_rcu() makes the first expectation node point back to
> that head, but nf_ct_ext_add() can later move the extension buffer with
> krealloc(). This leaves the node backpointer aimed at freed memory, so
> unlinking the expectation writes through a stale pointer.
> 
> Reserve the full u8-addressable extension space when adding the helper
> extension and reuse the existing buffer once the helper is present. This
> keeps the expectation list head stable while allowing later extensions
> to be added.
> 
> Fixes: 857b46027d6f ("netfilter: nft_ct: add ct expectations support")
> Bug found and triaged by OpenAI Security Research and 
> validated by Trail of Bits.

Thanks for your patch.

This is a duplicate of:

https://patchwork.ozlabs.org/project/netfilter-devel/patch/20260715144755.00ea7dfcd9f@xxxxxxxxx/

proposed fix tackles the problem from the ct expectation feature angle:

https://patchwork.ozlabs.org/project/netfilter-devel/patch/20260730150305.617144-1-pablo@xxxxxxxxxxxxx/