Re: [PATCH net 01/13] netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()

Hello:

This series was applied to netdev/net.git (main)
by Pablo Neira Ayuso <[email protected]>:

On Thu, 23 Jul 2026 18:38:58 +0200 you wrote:
> From: Xiang Mei <[email protected]>
> 
> sip_help_tcp() stores the size change of each NAT-rewritten SIP message
> in s16 diff and accumulates it in s16 tdiff, but a single message can
> grow by more than S16_MAX while the packet stays under the 65535
> enlarge_skb() limit: nf_nat_sip() rewrites every matching URI, and a long
> Contact list expands the message by tens of kilobytes. diff then wraps,
> and "datalen = datalen + diff - msglen" yields a huge unsigned datalen,
> so the next iteration's ct_sip_get_header() reads past the linearized skb
> tail.
> 
> [...]

Here is the summary with links:
  - [net,01/13] netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()
    https://git.kernel.org/netdev/net/c/db3d0e0e5d4b
  - [net,02/13] selftests: netfilter: nft_flowtable.sh: fix offload counter verification for tunnel tests
    https://git.kernel.org/netdev/net/c/1d6123f87eeb
  - [net,03/13] netfilter: nf_conntrack_expect: add and use nf_ct_expect_related_pair()
    https://git.kernel.org/netdev/net/c/4aa63842fc92
  - [net,04/13] netfilter: ipset: do not update comments from kernel-side hash adds
    https://git.kernel.org/netdev/net/c/f30415929be8
  - [net,05/13] ipvs: do not propagate one-packet flag to synced conns
    https://git.kernel.org/netdev/net/c/a63d2dbaeb50
  - [net,06/13] ipvs: adjust double hashing when fwd method changes
    https://git.kernel.org/netdev/net/c/712d2993bea5
  - [net,07/13] netfilter: nf_tables: make nft_object rhltable per table
    https://git.kernel.org/netdev/net/c/f4f699790590
  - [net,08/13] netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH
    https://git.kernel.org/netdev/net/c/305b63e14022
  - [net,09/13] ipvs: fix the checksum validations
    https://git.kernel.org/netdev/net/c/e876b75b9020
  - [net,10/13] ipvs: fix places with wrong packet offsets
    https://git.kernel.org/netdev/net/c/15cab31a3730
  - [net,11/13] ipvs: do not mangle ICMP replies for non-first fragments
    https://git.kernel.org/netdev/net/c/342e24a339b9
  - [net,12/13] ipvs: clear the nfct flag under lock
    https://git.kernel.org/netdev/net/c/da7d894c41d5
  - [net,13/13] netfilter: nft_payload: fix mask build for partial field offload
    https://git.kernel.org/netdev/net/c/39e88f28fb32

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html