Re: [PATCH net-next 11/12] netfilter: nf_conntrack_expect: bail out on insert dead expectations
Pablo Neira Ayuso <[email protected]>
| Newsgroups | gmane.comp.security.firewalls.netfilter.devel,gmane.linux.network |
|---|---|
| Message-ID | <anzal-pjpO6mg5Xv@chamomile> |
On Tue, Aug 11, 2026 at 06:34:47PM -0700, Jakub Kicinski wrote:
> This is an AI-generated review of your patch. The human sending this
> email has considered the AI review valid, or at least plausible.
> ---
> netfilter: nf_conntrack_expect: bail out on insert dead expectations
>
> This adds a check in nf_ct_expect_related_report() that refuses insertion
> of an expectation carrying NF_CT_EXPECT_DEAD, returning -EINVAL and
> triggering DEBUG_NET_WARN_ON_ONCE(). It is described as hardening for
> b8b09dc2bf35 ("netfilter: nf_conntrack_expect: use conntrack GC to reap
> expectations").
>
> A couple of questions about the placement of the new check and about the
> DEAD flag itself.
This is a real limitation on this new bug trap, I forgot to cover the
expect_related_pair() case, I will follow up to address it.