Subject: Re: [PATCH net] nfnetlink_osf: validate individual option lengths in fingerprints

From: Florian Westphal <[email-masked]>
Date: Thu, 19 Mar 2026 08:54:06 +0100

[email-masked] <[email-masked]> wrote:
> From: Weiming Shi <[email-masked]>
> 
> nfnl_osf_add_callback() validates opt_num bounds and string
> NUL-termination but does not check individual option length fields.
> A zero-length option causes nf_osf_match_one() to enter the option
> matching loop even when foptsize sums to zero, which matches packets
> with no TCP options where ctx->optp is NULL:

Applied, thanks.

How many people still use this feature?
Does this even work reliably in 2026?

I'm considering deprecation notice + eventual removal of this feature.