Re: [PATCH nf] netfilter: conntrack: prevent helper extension relocation

Hi,

On Wed, Jul 15, 2026 at 02:48:23PM +0000, Jaeyeong Lee wrote:
> nf_ct_ext_add() may relocate an unconfirmed conntrack's extension blob
> when the current allocation is too small. struct nf_conn_help embeds the
> hlist head for the master's expectations. The first expectation's
> lnode.pprev therefore points into that extension blob.
>
> An nftables CT expectation object can link an expectation before a later
> NAT expression adds extensions to the same unconfirmed conntrack. If an
> addition relocates the blob, the copied hlist head still points to the
> expectation, but the expectation's pprev continues to point into the
> freed old blob. Removing the expectation later executes hlist_del_rcu()
> and writes through this stale pointer.

Thanks for your patch.

For the record, I'm exploring an alternative fix from nft_ct
expectation support itself, patch should be available in the next
days.