mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-31 14:04:27 -04:00
Code Issues Packages Projects Releases Wiki Activity

netfilter: nf_conntrack_expect: consolidate check for insertion of dead expectation

Browse Source 
Consolidate the check for buggy expectations with DEAD flag on
insertion, which is called both by nf_ct_expect_related() and
nf_ct_expect_related_pair().

Fixes: e765c95faa ("netfilter: nf_conntrack_expect: bail out on insert dead expectations")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Pablo Neira Ayuso
2026-08-12 10:00:29 +02:00
parent 7904b94768
commit 5fc04d4648
1 changed files with 5 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
net/netfilter/nf_conntrack_expect.c
View File

@@ -477,6 +477,11 @@ static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect,
lockdep_nfct_expect_lock_held();
if (expect->flags & NF_CT_EXPECT_DEAD) {
DEBUG_NET_WARN_ON_ONCE(1);
return -EINVAL;
}
h = nf_ct_expect_dst_hash(net, &expect->tuple);
hlist_for_each_entry_safe(i, next, &nf_ct_expect_hash[h], hnode) {
if (nf_ct_exp_is_expired(i)) {
@@ -528,12 +533,6 @@ int nf_ct_expect_related_report(struct nf_conntrack_expect *expect,
int ret;
spin_lock_bh(&nf_conntrack_expect_lock);
if (expect->flags & NF_CT_EXPECT_DEAD) {
DEBUG_NET_WARN_ON_ONCE(1);
ret = -EINVAL;
goto out;
}
master_help = nfct_help(expect->master);
if (!master_help) {
ret = -ESHUTDOWN;