Re: [PATCH net 10/14] netfilter: ctnetlink: ensure safe access to master conntrack

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Wed, Mar 25, 2026 at 06:28:58PM +0100, Florian Westphal wrote:
> Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > Sorry for this late followup incremental fix.
> 
> I'm tired.
> 
> > diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
> > index 509d3eb6f56a..cf39662c4b97 100644
> > --- a/net/netfilter/nf_conntrack_expect.c
> > +++ b/net/netfilter/nf_conntrack_expect.c
> > @@ -325,7 +325,9 @@ void nf_ct_expect_init(struct nf_conntrack_expect *exp, unsigned int class,
> >  		       u_int8_t proto, const __be16 *src, const __be16 *dst)
> >  {
> >  	struct net *net = read_pnet(&exp->master->ct_net);
> > -
> > +	struct nf_conntrack_helper *helper;
> > +	struct nf_conn *ct = exp->master;
> > +	struct nf_conn_help *help;
> >  	int len;
> >  
> >  	if (family == AF_INET)
> > @@ -336,7 +338,14 @@ void nf_ct_expect_init(struct nf_conntrack_expect *exp, unsigned int class,
> >  	exp->flags = 0;
> >  	exp->class = class;
> >  	exp->expectfn = NULL;
> > -	rcu_assign_pointer(exp->helper, nfct_help(exp->master)->helper);
> > +	help = nfct_help(ct);
> 
> Do we have a reference here? Is that safe?

This ct is coming from the skb from packet path, while rcu_read_lock()
is held, the skb owns this ct.

> I'm not looking forward to a new PR.

Apologies.