Files
linux/include/net
Florian Westphal 207b3ebacb netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation
Ulrich reports a regression with nfqueue:

If an application did not set the 'F_GSO' capability flag and a gso
packet with an unconfirmed nf_conn entry is received all packets are
now dropped instead of queued, because the check happens after
skb_gso_segment().  In that case, we did have exclusive ownership
of the skb and its associated conntrack entry.  The elevated use
count is due to skb_clone happening via skb_gso_segment().

Move the check so that its peformed vs. the aggregated packet.

Then, annotate the individual segments except the first one so we
can do a 2nd check at reinject time.

For the normal case, where userspace does in-order reinjects, this avoids
packet drops: first reinjected segment continues traversal and confirms
entry, remaining segments observe the confirmed entry.

While at it, simplify nf_ct_drop_unconfirmed(): We only care about
unconfirmed entries with a refcnt > 1, there is no need to special-case
dying entries.

This only happens with UDP.  With TCP, the only unconfirmed packet will
be the TCP SYN, those aren't aggregated by GRO.

Next patch adds a udpgro test case to cover this scenario.

Reported-by: Ulrich Weber <ulrich.weber@gmail.com>
Fixes: 7d8dc1c7be ("netfilter: nf_queue: drop packets with cloned unconfirmed conntracks")
Signed-off-by: Florian Westphal <fw@strlen.de>
2026-02-06 13:34:55 +01:00
..
2025-11-03 16:49:53 +09:00
2024-10-08 15:33:49 -07:00
2026-01-27 10:45:38 +01:00
2025-09-02 15:52:24 -07:00
2025-11-03 17:40:46 -08:00
2025-04-24 17:03:45 -07:00
2025-07-08 18:05:25 -07:00
2026-01-27 10:45:38 +01:00
2022-08-09 22:14:02 -07:00
2024-05-08 10:35:09 +01:00
2024-08-26 09:37:23 -07:00
2024-11-13 18:49:50 -08:00
2024-08-26 09:37:23 -07:00
2025-08-26 17:34:31 -07:00
2025-09-03 15:16:49 -07:00
2026-01-21 19:28:32 -08:00
2024-05-07 01:35:55 +02:00
2026-01-13 10:12:11 +01:00
2024-08-26 09:37:23 -07:00
2025-09-22 11:38:43 -07:00
2024-02-28 11:19:41 +00:00
2025-08-26 17:34:31 -07:00
2024-12-06 17:43:08 -08:00
2021-10-13 09:40:46 -07:00
2024-08-26 09:37:23 -07:00
2025-04-15 08:21:46 -07:00
2026-01-27 10:45:38 +01:00
2023-07-14 20:39:30 -07:00
2025-09-18 12:32:06 +02:00
2024-08-26 09:37:23 -07:00
2024-08-26 09:37:23 -07:00
2025-09-03 15:08:20 -07:00
2025-04-11 18:58:10 -07:00
2025-07-04 09:32:35 +02:00
2025-04-11 18:58:10 -07:00
2024-05-30 18:29:38 -07:00
2025-09-08 18:06:21 -07:00
2023-10-04 11:49:20 -07:00
2025-07-11 11:00:57 -07:00
2023-07-28 14:07:59 -07:00
2022-12-12 15:04:39 -08:00
2026-01-06 17:06:03 -08:00
2023-09-14 16:16:36 +02:00