mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-27 17:35:18 -04:00
Code Issues Packages Projects Releases Wiki Activity

netfilter: nf_conntrack_expect: bail out on insert dead expectations

Browse Source 
If the NF_CT_EXPECT_DEAD expectation flag is set on, bail out on
insertion. Moreover, add also DEBUG_NET_WARN_ON_ONCE() since this should
not ever happen. This is hardening commit b8b09dc2bf ("netfilter:
nf_conntrack_expect: use conntrack GC to reap expectations").

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Pablo Neira Ayuso
2026-08-10 12:31:24 +02:00
parent 73df81b38c
commit e765c95faa
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
net/netfilter/nf_conntrack_expect.c
View File

@@ -528,6 +528,12 @@ int nf_ct_expect_related_report(struct nf_conntrack_expect *expect,
int ret;
spin_lock_bh(&nf_conntrack_expect_lock);
if (expect->flags & NF_CT_EXPECT_DEAD) {
DEBUG_NET_WARN_ON_ONCE(1);
ret = -EINVAL;
goto out;
}
master_help = nfct_help(expect->master);
if (!master_help) {
ret = -ESHUTDOWN;