From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 17EC33382C7; Sat, 17 Oct 2026 16:55:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792256117; cv=none; b=jwLNc0xux1PySwjTGjaNON2Osk2vQU74k3BiZ3SHoxrXir+oU10LW4RSNsbNith3V15DjQyBqUMu7vMovgO87H0wczS5wTH5UwWYACiuRN1tTHRxEDIvMont2siNBmcO1xf/PtZu0LUHB/vV+t8+47y+kv3Ubrzzv588avPP53Y= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792256117; c=relaxed/simple; bh=MYf6OqjY7rR5QyzYH4dflUfYr8Qvq/RQHAMYJXoe1xU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=W5chetE2O6CJfd7C0rD1U+IOrY5qOnCIvzDohD+ku5uw3oShRVczAICgyD88MCz98wDSQrmTxYpiV7UOe3LA/wK8G/Ry9oCSL58v0dN/KYsOZHNjijZ54yccUmrOtZQFxugG6RxeSiKPcuXqaIphQYTv59HdXbYhIj6ig2ko7AY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=0p/UiR+V; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="0p/UiR+V" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 392641F000C4; Sat, 17 Oct 2026 16:55:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1792256115; bh=MhYchBWLmYLA3cUbFSTHafKc/O0OXYlNakX11hoIJ0Q=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=0p/UiR+Vm2BtL7YczHbNwD9enyO1fQkBROk0UMds4Md2aC8PW4+IooMb2Ekn7rGgF goWJ8ZqFAORWy1vr9arxwIm8KXJ1lNem1+kt6losl55j/DKUM8NNlHssBmaI818Pmm kiFVkcVsWnvKalUhqzKdZtxMdRSGEkrj/UAK+fBA= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Ilya Maximets , Aaron Conole , Jakub Kicinski , Sasha Levin Subject: [PATCH 6.6 0131/1674] net: openvswitch: conntrack: remove add_helper dead code Date: Sat, 17 Oct 2026 17:40:03 +0200 Message-ID: <20261017160434.525150425@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261017160431.119607952@linuxfoundation.org> References: <20261017160431.119607952@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: Ilya Maximets [ Upstream commit 5e6c14dd42a1c1fe938e573dc6c9098145b2b0c4 ] This variable can only become 'true' when the connection is not confirmed, but it is only checked when it is confirmed. So, it can be treated as being always false and just removed. Fixes: 3c1860543fcc ("openvswitch: add nf_ct_is_confirmed check before assigning the helper") Cc: stable@vger.kernel.org Signed-off-by: Ilya Maximets Reviewed-by: Aaron Conole Link: https://patch.msgid.link/20260921145655.3167436-3-i.maximets@ovn.org Signed-off-by: Jakub Kicinski Stable-dep-of: 1a4151e6be57 ("net: openvswitch: conntrack: fix helper UAF due to extensions realloc") Signed-off-by: Sasha Levin --- net/openvswitch/conntrack.c | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c index df48c4c90b8d9..acfef7f14bce2 100644 --- a/net/openvswitch/conntrack.c +++ b/net/openvswitch/conntrack.c @@ -779,8 +779,6 @@ static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key, ct = nf_ct_get(skb, &ctinfo); if (ct) { - bool add_helper = false; - /* Packets starting a new connection must be NATted before the * helper, so that the helper knows about the NAT. We enforce * this by delaying both NAT and helper calls for unconfirmed @@ -812,7 +810,6 @@ static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key, GFP_ATOMIC); if (err) return err; - add_helper = true; /* helper installed, add seqadj if NAT is required */ if (info->nat && !nfct_seqadj(ct)) { @@ -822,13 +819,10 @@ static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key, } /* Call the helper only if: - * - nf_conntrack_in() was executed above ("!cached") or a - * helper was just attached ("add_helper") for a confirmed - * connection, or + * - nf_conntrack_in() was executed above ("!cached"), or * - When committing an unconfirmed connection. */ - if ((nf_ct_is_confirmed(ct) ? !cached || add_helper : - info->commit)) { + if ((nf_ct_is_confirmed(ct) ? !cached : info->commit)) { int err = nf_ct_helper(skb, ct, ctinfo, info->family); err = verdict_to_errno(err); -- 2.53.0