Re: [PATCH nf,v2 1/2] netfilter: ctnetlink: reject expectation deletions on unconfirmed conntrack

On Wed, Jul 29, 2026 at 01:35:47PM +0200, Pablo Neira Ayuso wrote:
> ctnetlink allows to reach expectations that refer to unconfirmed
> conntrack. The ct extension area of unconfirmed conntrack could be
> reallocated while the packet is in transit.
> 
> While holding the spinlock, check if the master conntrack is
> unconfirmed. The existing expectation spinlock ensures that the master
> conntrack is still alive because nf_ct_remove_expectations() tears down
> all expectations on conntrack removal. So, while holding the spinlock,
> the lifetime of the expectations is attached to the master conntrack.

Scratch this series, I'm not tackling the issue from the right angle.

Will follow up asap.