[PATCH] netfilter: nft_ct: validate timeout object protocol

nft_ct_timeout_obj_eval() only compares the timeout object protocol with
packet metadata. A packet header can be changed after conntrack attaches
an entry, so this metadata does not necessarily describe the entry.

Timeout objects contain protocol-specific arrays. Attaching an object for
a protocol with fewer timeout states to an entry for one with more states
lets the conntrack tracker read beyond the object.

Require the object protocol to match the conntrack tuple protocol before
attaching it. This mirrors validation by named timeout policies and
nftables conntrack helper objects.

Fixes: 0434ccdcf883 ("netfilter: nf_tables: rework ct timeout set support")
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Kyle Zeng <[email protected]>
---
 net/netfilter/nft_ct.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c
index 03a88c7..d618bfa 100644
--- a/net/netfilter/nft_ct.c
+++ b/net/netfilter/nft_ct.c
@@ -885,7 +885,8 @@ static void nft_ct_timeout_obj_eval(struct nft_object *obj,
 	if (priv->l4proto != pkt->tprot)
 		return;
 
-	if (!ct || nf_ct_is_template(ct) || nf_ct_is_confirmed(ct))
+	if (!ct || nf_ct_is_template(ct) || nf_ct_is_confirmed(ct) ||
+	    priv->l4proto != nf_ct_protonum(ct))
 		return;
 
 	timeout = nf_ct_timeout_find(ct);