diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2026-08-10 12:31:24 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2026-08-10 21:20:44 +0200 |
| commit | e765c95faa10a8b4e6e9ac7d338eca9662dc56da (patch) | |
| tree | b085967c714465b65a82da76a9be0742941b41c0 | |
| parent | 73df81b38cb7f70a347a97370386378a86e53019 (diff) | |
| download | linux-next-e765c95faa10a8b4e6e9ac7d338eca9662dc56da.tar.gz linux-next-e765c95faa10a8b4e6e9ac7d338eca9662dc56da.zip | |
netfilter: nf_conntrack_expect: bail out on insert dead expectations
If the NF_CT_EXPECT_DEAD expectation flag is set on, bail out on
insertion. Moreover, add also DEBUG_NET_WARN_ON_ONCE() since this should
not ever happen. This is hardening commit b8b09dc2bf35 ("netfilter:
nf_conntrack_expect: use conntrack GC to reap expectations").
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| -rw-r--r-- | net/netfilter/nf_conntrack_expect.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c index 10b130a7b230..f1f0c582db5d 100644 --- a/net/netfilter/nf_conntrack_expect.c +++ b/net/netfilter/nf_conntrack_expect.c @@ -528,6 +528,12 @@ int nf_ct_expect_related_report(struct nf_conntrack_expect *expect, int ret; spin_lock_bh(&nf_conntrack_expect_lock); + if (expect->flags & NF_CT_EXPECT_DEAD) { + DEBUG_NET_WARN_ON_ONCE(1); + ret = -EINVAL; + goto out; + } + master_help = nfct_help(expect->master); if (!master_help) { ret = -ESHUTDOWN; |