Re: [PATCH net 0/4] net/sched: reset conntrack after packet munging

On Thu, Aug 20, 2026 at 1:37 PM Florian Westphal <[email protected]> wrote:
>
> Jamal Hadi Salim <[email protected]> wrote:
> > > Yes, e.g. what if pedit inflated th->doff?
> > > nf_conntrack_in() checked that this was fine, but now the pipeline
> > > can re-neg on that.
> >
> > True.
> > So my question to you then is: what about BPF, OVS, future thingy? Are
> > you going to fix each individually?
>
> I see no alternative?  I mean, what are you suggesting?
>
> We can apply the patch from Kyle, that will stop the reproducer.
> But I can tell you that we'll need hundreds of followup patches
> all over.
>
> I mean, we always relied on IP stack having checked that iph->ihl is
> fine, the ipv6 header is complete, etc.
>
> And that isn't exclusive to netfilter.
>

Agreed.
My suggestion is: if you fix pedit then fix all other sources.
Kyle should be able to provide repros for the others (ebpf etc).

cheers,
jamal

> My best suggestion is to remove skb->_nfct and reparse everywhere,
> but I will NOT make such a patch, IMO conntrack and netfilter might
> as well be axed then.  Hey, would solve a few bugs.