Re: [PATCH nf] netfilter: nf_nat: do not reuse an unexpected expectation on RTCP clash

On Sat, Jul 11, 2026 at 06:29:31PM +0200, Florian Westphal wrote:
> Jaeyeong Lee <[email protected]> wrote:
> > Since commit b8b09dc2bf35 ("netfilter: nf_conntrack_expect: use conntrack
> > GC to reap expectations") nf_ct_unexpect_related() no longer unlinks the
> > expectation from the global hash and from the per-master list. It only
> > marks it with NF_CT_EXPECT_DEAD and defers the unlink to the conntrack GC
> 
> [..]
> 
> > and then continues the loop, reusing the very same rtp_exp object:
> > 
> > 	ret = nf_ct_expect_related(rtcp_exp, ...);
> > 	...
> 
> I think this function should WARN_ON_ONCE when one tries to reinsert a
> dead expectation (and return -EINVAL or another appropriate error).
> 
> (This is indenpendent of the real fix).

If you do that, then the machine will reboot, loosing everything.  Are
you sure you want that to happen?  Why not just properly handle the
issue if it possibly could happen?

thanks,

greg k-h