)]}'
{
  "commit": "3b08fed5b7e0d5e3a25d73ef3ba09cd33ade16c9",
  "tree": "f206d5080cbce8fa09322d9ab39ee0f3d300a13e",
  "parents": [
    "6d27e29a90bc6a717b97c6ddcd866db7bd8e4adc"
  ],
  "author": {
    "name": "Xiang Mei",
    "email": "xmei5@asu.edu",
    "time": "Sun Jul 05 16:36:29 2026 -0700"
  },
  "committer": {
    "name": "Florian Westphal",
    "email": "fw@strlen.de",
    "time": "Wed Jul 08 15:22:03 2026 +0200"
  },
  "message": "netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag\n\nnf_ct_frag6_reasm() slides the packet head forward to drop the IPv6\nfragment header and then unconditionally advances skb-\u003emac_header:\n\n\tskb-\u003emac_header +\u003d sizeof(struct frag_hdr);\n\nOn the NF_INET_LOCAL_OUT defrag path the skb has no link-layer header\nyet, so skb-\u003emac_header is still the \"not set\" sentinel (u16)~0U. Adding\nsizeof(struct frag_hdr) wraps it to a small value (0xffff + 8 \u003d\u003d 7),\nafter which skb_mac_header_was_set() wrongly reports a MAC header is\npresent and skb_mac_header() points into the headroom.\n\nThe reassembler has done this unconditional add since it was introduced;\nit was harmless while mac_header was a bare pointer, but wrong once\nmac_header became a u16 offset whose unset state is the ~0U sentinel\ntested by skb_mac_header_was_set(). The sibling net/ipv6/reassembly.c\ndoes the same relocation and does guard the adjustment; mirror the\nguard here.\n\nFixes: 9fb9cbb1082d (\"[NETFILTER]: Add nf_conntrack subsystem.\")\nCc: stable@vger.kernel.org\nReported-by: Weiming Shi \u003cbestswngs@gmail.com\u003e\nAssisted-by: Claude:claude-opus-4-8\nSigned-off-by: Xiang Mei \u003cxmei5@asu.edu\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "64ab23ff559bb9e97b989d19802480c703cdbcbe",
      "old_mode": 33188,
      "old_path": "net/ipv6/netfilter/nf_conntrack_reasm.c",
      "new_id": "3637b20d3fa44e5ff92c56082d05be3374824e76",
      "new_mode": 33188,
      "new_path": "net/ipv6/netfilter/nf_conntrack_reasm.c"
    }
  ]
}