Re: Backport request: "netfilter: nf_conntrack_expect: restore helper propagation via expectation"

On 7/30/26 4:09 PM, Greg KH wrote:
> On Thu, Jul 30, 2026 at 01:07:39AM +0200, Pablo Neira Ayuso wrote:
>> On Wed, Jul 29, 2026 at 11:38:17PM +0200, Ilya Maximets wrote:
>>> Hi.  The mentioned commit dcb0f9aefdd604d36710fda53c25bd7cf4a3e37a
>>> was backported to 7.0, but not further, while two commits it is fixing
>>> were backported down to 6.1.
>>>
>>> Admittedly, the patch is not very important as far as functionality
>>> goes (at least for FTP), but the issue does change the user visible
>>> behavior and that makes all the FTP system tests in openvswitch
>>> project (in userspace) to fail.  This makes it harder to validate OVS
>>> on kernels below 7.0 and makes it unnecessarily harder to validate
>>> changes for the openvswitch kernel module on stable kernels.
>>>
>>> So, it would be really nice to have the fix backported to the same
>>> branches where the commits it fixes were (6.1).
>>>
>>> AFAICT, cherry-pick works without conflicts down to 6.6.  For 6.1
>>> there is a minor conflict, 6.1.y has the extra debug message:
>>>
>>> diff --cc net/netfilter/nf_conntrack_core.c
>>> index f5c466ea1e7d,8ba5b22a1eef..000000000000
>>> --- a/net/netfilter/nf_conntrack_core.c
>>> +++ b/net/netfilter/nf_conntrack_core.c
>>> @@@ -1800,8 -1811,8 +1800,10 @@@ init_conntrack(struct net *net, struct 
>>>   		spin_lock_bh(&nf_conntrack_expect_lock);
>>>   		exp = nf_ct_find_expectation(net, zone, tuple, !tmpl || nf_ct_is_confirmed(tmpl));
>>>   		if (exp) {
>>> + 			struct nf_conntrack_helper *assign_helper;
>>> + 
>>>  +			pr_debug("expectation arrives ct=%p exp=%p\n",
>>>  +				 ct, exp);
>>>   			/* Welcome, Mr. Bond.  We've been expecting you... */
>>>   			__set_bit(IPS_EXPECTED_BIT, &ct->status);
>>>   			/* exp->master safe, refcnt bumped in nf_ct_find_expectation */
>>> ---
>>>
>>> WDYT?
>>
>> I am fine with getting dcb0f9aefdd604d36710fda53c25bd7cf4a3e37a into
>> -stable release < 7.0 if that is what you mean.
>>
> 
> Great, can someone send us properly backported/tested patches to apply?
If that works, once my testing is done, I can send two patches - one for
6.18.y that should be applicable down to 6.6 (I'm running tests on all
intermediate supported versions at the moment) and one for 6.1 with the
conflict resolution above.

Best regards, Ilya Maximets.