Backport request: "netfilter: nf_conntrack_expect: restore helper propagation via expectation"

Ilya Maximets <[email protected]> Wed, 29 Jul 2026 23:38:17 +0200
Newsgroups gmane.comp.security.firewalls.netfilter.devel,gmane.linux.kernel.stable
Message-ID <[email protected]>
Hi.  The mentioned commit dcb0f9aefdd604d36710fda53c25bd7cf4a3e37a
was backported to 7.0, but not further, while two commits it is fixing
were backported down to 6.1.

Admittedly, the patch is not very important as far as functionality
goes (at least for FTP), but the issue does change the user visible
behavior and that makes all the FTP system tests in openvswitch
project (in userspace) to fail.  This makes it harder to validate OVS
on kernels below 7.0 and makes it unnecessarily harder to validate
changes for the openvswitch kernel module on stable kernels.

So, it would be really nice to have the fix backported to the same
branches where the commits it fixes were (6.1).

AFAICT, cherry-pick works without conflicts down to 6.6.  For 6.1
there is a minor conflict, 6.1.y has the extra debug message:

diff --cc net/netfilter/nf_conntrack_core.c
index f5c466ea1e7d,8ba5b22a1eef..000000000000
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@@ -1800,8 -1811,8 +1800,10 @@@ init_conntrack(struct net *net, struct 
  		spin_lock_bh(&nf_conntrack_expect_lock);
  		exp = nf_ct_find_expectation(net, zone, tuple, !tmpl || nf_ct_is_confirmed(tmpl));
  		if (exp) {
+ 			struct nf_conntrack_helper *assign_helper;
+ 
 +			pr_debug("expectation arrives ct=%p exp=%p\n",
 +				 ct, exp);
  			/* Welcome, Mr. Bond.  We've been expecting you... */
  			__set_bit(IPS_EXPECTED_BIT, &ct->status);
  			/* exp->master safe, refcnt bumped in nf_ct_find_expectation */
---

WDYT?

Best regards, Ilya Maximets.