diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2026-08-12 10:00:29 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2026-08-18 00:54:40 +0200 |
| commit | 5fc04d4648f4e699e0df7982e37bcdec23daf39c (patch) | |
| tree | e860ee002bce9c18848a1b8766b9b8f346c6f562 | |
| parent | 7904b94768e983bcb2be34a8d6d1f3450f5b838b (diff) | |
| download | linux-5fc04d4648f4e699e0df7982e37bcdec23daf39c.tar.gz linux-5fc04d4648f4e699e0df7982e37bcdec23daf39c.zip | |
netfilter: nf_conntrack_expect: consolidate check for insertion of dead expectation
Consolidate the check for buggy expectations with DEAD flag on
insertion, which is called both by nf_ct_expect_related() and
nf_ct_expect_related_pair().
Fixes: e765c95faa10 ("netfilter: nf_conntrack_expect: bail out on insert dead expectations")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| -rw-r--r-- | net/netfilter/nf_conntrack_expect.c | 11 |
1 files changed, 5 insertions, 6 deletions
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c index f1f0c582db5d..06242c86e1dc 100644 --- a/net/netfilter/nf_conntrack_expect.c +++ b/net/netfilter/nf_conntrack_expect.c @@ -477,6 +477,11 @@ static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect, lockdep_nfct_expect_lock_held(); + if (expect->flags & NF_CT_EXPECT_DEAD) { + DEBUG_NET_WARN_ON_ONCE(1); + return -EINVAL; + } + h = nf_ct_expect_dst_hash(net, &expect->tuple); hlist_for_each_entry_safe(i, next, &nf_ct_expect_hash[h], hnode) { if (nf_ct_exp_is_expired(i)) { @@ -528,12 +533,6 @@ int nf_ct_expect_related_report(struct nf_conntrack_expect *expect, int ret; spin_lock_bh(&nf_conntrack_expect_lock); - if (expect->flags & NF_CT_EXPECT_DEAD) { - DEBUG_NET_WARN_ON_ONCE(1); - ret = -EINVAL; - goto out; - } - master_help = nfct_help(expect->master); if (!master_help) { ret = -ESHUTDOWN; |