From e765c95faa10a8b4e6e9ac7d338eca9662dc56da Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Mon, 10 Aug 2026 12:31:24 +0200 Subject: [PATCH] netfilter: nf_conntrack_expect: bail out on insert dead expectations If the NF_CT_EXPECT_DEAD expectation flag is set on, bail out on insertion. Moreover, add also DEBUG_NET_WARN_ON_ONCE() since this should not ever happen. This is hardening commit b8b09dc2bf35 ("netfilter: nf_conntrack_expect: use conntrack GC to reap expectations"). Signed-off-by: Pablo Neira Ayuso --- net/netfilter/nf_conntrack_expect.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c index 10b130a7b230..f1f0c582db5d 100644 --- a/net/netfilter/nf_conntrack_expect.c +++ b/net/netfilter/nf_conntrack_expect.c @@ -528,6 +528,12 @@ int nf_ct_expect_related_report(struct nf_conntrack_expect *expect, int ret; spin_lock_bh(&nf_conntrack_expect_lock); + if (expect->flags & NF_CT_EXPECT_DEAD) { + DEBUG_NET_WARN_ON_ONCE(1); + ret = -EINVAL; + goto out; + } + master_help = nfct_help(expect->master); if (!master_help) { ret = -ESHUTDOWN;