[PATCH] netfilter: nf_conntrack: avoid truncating IPv6 nexthdr offset

find_prev_fhdr() returns the offset of the Next Header field before an IPv6
Fragment header through an int pointer, but stores the offset in a u8 local.
An extension header chain can put this field beyond byte 255, causing the
offset to wrap before it is saved in the fragment queue.

Reassembly later uses the wrapped value to update the preceding Next Header
field.  This overwrites another byte in the IPv6 header chain and can make
conntrack parse a different transport tuple from the one used by IPv6 local
delivery.  A two-fragment packet can, for example, be recorded as UDP
destination port 53 while its payload is delivered to UDP port 9999.

Use int for the working offset, matching the output argument and the other
offset variables in this path.

Fixes: 9fb9cbb1082d ("[NETFILTER]: Add nf_conntrack subsystem.")
Assisted-by: Codex:gpt-5
Signed-off-by: Jérémy Jean <redacted>
---
 net/ipv6/netfilter/nf_conntrack_reasm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index 599c49bf0a0a..be72c4346f8b 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c

@@ -398,7 +398,7 @@ find_prev_fhdr(struct sk_buff *skb, u8 *prevhdrp, int *prevhoff, int *fhoff)
 {
 	u8 nexthdr = ipv6_hdr(skb)->nexthdr;
 	const int netoff = skb_network_offset(skb);
-	u8 prev_nhoff = netoff + offsetof(struct ipv6hdr, nexthdr);
+	int prev_nhoff = netoff + offsetof(struct ipv6hdr, nexthdr);
 	int start = netoff + sizeof(struct ipv6hdr);
 	int len = skb->len - start;
 	u8 prevhdr = NEXTHDR_IPV6;

-- 
2.47.3