Re: [PATCH nf v2 1/2] netfilter: nf_conntrack_tcp: defer timeout-lowering invalid log until after unlock

Pablo Neira Ayuso <[email protected]> Fri, 31 Jul 2026 12:26:25 +0200
Newsgroups gmane.comp.security.firewalls.netfilter.devel
Message-ID <amx4UazjtsEtlsdR@chamomile>
On Thu, Jul 30, 2026 at 01:55:43PM +0000, Zihan Xi wrote:
> @@ -971,6 +967,7 @@ int nf_conntrack_tcp_packet(struct nf_conn *ct,
>  	enum tcp_conntrack new_state, old_state;
>  	unsigned int index, *timeouts;
>  	enum nf_ct_tcp_action res;
> +	bool lowered_timeout = false;
>  	enum ip_conntrack_dir dir;
>  	const struct tcphdr *th;
>  	struct tcphdr _tcph;

Cosmetic nitpick, reserve xmas tree whenever possible is preferred,
ie.

 	enum tcp_conntrack new_state, old_state;
 	unsigned int index, *timeouts;
+	bool lowered_timeout = false;
 	enum nf_ct_tcp_action res;
 	enum ip_conntrack_dir dir;
 	const struct tcphdr *th;
 	struct tcphdr _tcph;