[PATCH nf] netfilter: nf_conntrack_expect: zero at allocation time

[PATCH nf] netfilter: nf_conntrack_expect: zero at allocation time

[Florian Westphal]

There are occasional LLM hints wrt. leaking uninitialized data to
userspace via ctnetlink.  Just zero at allocation time, expectations are
not frequently used these days.

Intentionally keeps _init as-is because we could theoretically support
re-init, so add the missing exp->dir there.

Signed-off-by: Florian Westphal <fw@strlen.de>
---
 net/netfilter/nf_conntrack_expect.c  |  3 ++-
 net/netfilter/nf_conntrack_netlink.c | 11 +----------
 2 files changed, 3 insertions(+), 11 deletions(-)

diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index 49e18eda037e..0b213ffc0378 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -306,7 +306,7 @@ struct nf_conntrack_expect *nf_ct_expect_alloc(struct nf_conn *me)
 {
 	struct nf_conntrack_expect *new;
 
-	new = kmem_cache_alloc(nf_ct_expect_cachep, GFP_ATOMIC);
+	new = kmem_cache_zalloc(nf_ct_expect_cachep, GFP_ATOMIC);
 	if (!new)
 		return NULL;
 
@@ -389,6 +389,7 @@ void nf_ct_expect_init(struct nf_conntrack_expect *exp, unsigned int class,
 #if IS_ENABLED(CONFIG_NF_NAT)
 	memset(&exp->saved_addr, 0, sizeof(exp->saved_addr));
 	memset(&exp->saved_proto, 0, sizeof(exp->saved_proto));
+	exp->dir = 0;
 #endif
 }
 EXPORT_SYMBOL_GPL(nf_ct_expect_init);
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 4e78d2482989..c6daeea35044 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -3565,8 +3565,6 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct,
 	if (cda[CTA_EXPECT_FLAGS]) {
 		exp->flags = ntohl(nla_get_be32(cda[CTA_EXPECT_FLAGS]));
 		exp->flags &= ~NF_CT_EXPECT_USERSPACE;
-	} else {
-		exp->flags = 0;
 	}
 	if (cda[CTA_EXPECT_FN]) {
 		const char *name = nla_data(cda[CTA_EXPECT_FN]);
@@ -3578,8 +3576,7 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct,
 			goto err_out;
 		}
 		exp->expectfn = expfn->expectfn;
-	} else
-		exp->expectfn = NULL;
+	}
 
 	exp->class = class;
 	exp->master = ct;
@@ -3598,12 +3595,6 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct,
 						 exp, nf_ct_l3num(ct));
 		if (err < 0)
 			goto err_out;
-#if IS_ENABLED(CONFIG_NF_NAT)
-	} else {
-		memset(&exp->saved_addr, 0, sizeof(exp->saved_addr));
-		memset(&exp->saved_proto, 0, sizeof(exp->saved_proto));
-		exp->dir = 0;
-#endif
 	}
 	return exp;
 err_out:
-- 
2.53.0

Re: [PATCH nf] netfilter: nf_conntrack_expect: zero at allocation time

[Pablo Neira Ayuso]

On Thu, Jun 25, 2026 at 02:13:53AM +0200, Florian Westphal wrote:
> There are occasional LLM hints wrt. leaking uninitialized data to
> userspace via ctnetlink.  Just zero at allocation time, expectations are
> not frequently used these days.

Fine with me. IIRC hints came because of real issue, ie. paths where
I was missing to initial something.

> Intentionally keeps _init as-is because we could theoretically support
> re-init, so add the missing exp->dir there.
> 
> Signed-off-by: Florian Westphal <fw@strlen.de>
> ---
>  net/netfilter/nf_conntrack_expect.c  |  3 ++-
>  net/netfilter/nf_conntrack_netlink.c | 11 +----------
>  2 files changed, 3 insertions(+), 11 deletions(-)
> 
> diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
> index 49e18eda037e..0b213ffc0378 100644
> --- a/net/netfilter/nf_conntrack_expect.c
> +++ b/net/netfilter/nf_conntrack_expect.c
> @@ -306,7 +306,7 @@ struct nf_conntrack_expect *nf_ct_expect_alloc(struct nf_conn *me)
>  {
>  	struct nf_conntrack_expect *new;
>  
> -	new = kmem_cache_alloc(nf_ct_expect_cachep, GFP_ATOMIC);
> +	new = kmem_cache_zalloc(nf_ct_expect_cachep, GFP_ATOMIC);
>  	if (!new)
>  		return NULL;
>  
> @@ -389,6 +389,7 @@ void nf_ct_expect_init(struct nf_conntrack_expect *exp, unsigned int class,
>  #if IS_ENABLED(CONFIG_NF_NAT)
>  	memset(&exp->saved_addr, 0, sizeof(exp->saved_addr));
>  	memset(&exp->saved_proto, 0, sizeof(exp->saved_proto));
> +	exp->dir = 0;

Hm. But now area is expect is zeroed, right?

Maybe nf_ct_expect_init() needs to be updated to remove needless
zeroing too?

Thanks!

>  #endif
>  }
>  EXPORT_SYMBOL_GPL(nf_ct_expect_init);
> diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
> index 4e78d2482989..c6daeea35044 100644
> --- a/net/netfilter/nf_conntrack_netlink.c
> +++ b/net/netfilter/nf_conntrack_netlink.c
> @@ -3565,8 +3565,6 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct,
>  	if (cda[CTA_EXPECT_FLAGS]) {
>  		exp->flags = ntohl(nla_get_be32(cda[CTA_EXPECT_FLAGS]));
>  		exp->flags &= ~NF_CT_EXPECT_USERSPACE;
> -	} else {
> -		exp->flags = 0;
>  	}
>  	if (cda[CTA_EXPECT_FN]) {
>  		const char *name = nla_data(cda[CTA_EXPECT_FN]);
> @@ -3578,8 +3576,7 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct,
>  			goto err_out;
>  		}
>  		exp->expectfn = expfn->expectfn;
> -	} else
> -		exp->expectfn = NULL;
> +	}
>  
>  	exp->class = class;
>  	exp->master = ct;
> @@ -3598,12 +3595,6 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct,
>  						 exp, nf_ct_l3num(ct));
>  		if (err < 0)
>  			goto err_out;
> -#if IS_ENABLED(CONFIG_NF_NAT)
> -	} else {
> -		memset(&exp->saved_addr, 0, sizeof(exp->saved_addr));
> -		memset(&exp->saved_proto, 0, sizeof(exp->saved_proto));
> -		exp->dir = 0;
> -#endif
>  	}
>  	return exp;
>  err_out:
> -- 
> 2.53.0
> 
> 

Re: [PATCH nf] netfilter: nf_conntrack_expect: zero at allocation time

[Florian Westphal]

Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> On Thu, Jun 25, 2026 at 02:13:53AM +0200, Florian Westphal wrote:
> > There are occasional LLM hints wrt. leaking uninitialized data to
> > userspace via ctnetlink.  Just zero at allocation time, expectations are
> > not frequently used these days.
> 
> Fine with me. IIRC hints came because of real issue, ie. paths where
> I was missing to initial something.


> > @@ -389,6 +389,7 @@ void nf_ct_expect_init(struct nf_conntrack_expect *exp, unsigned int class,
> >  #if IS_ENABLED(CONFIG_NF_NAT)
> >  	memset(&exp->saved_addr, 0, sizeof(exp->saved_addr));
> >  	memset(&exp->saved_proto, 0, sizeof(exp->saved_proto));
> > +	exp->dir = 0;
> 
> Hm. But now area is expect is zeroed, right?
> 
> Maybe nf_ct_expect_init() needs to be updated to remove needless
> zeroing too?

See:
> > Intentionally keeps _init as-is because we could theoretically support
> > re-init, so add the missing exp->dir there.

If you say we are guaranteed to always have:

exp = nf_ct_expect_alloc(ct);
nf_ct_expect_init(exp)

then we could remove it.  But then I'd question why we even have this
alloc / init split and not:

exp = nf_ct_expect_new(rtp_exp, NF_CT_EXPECT_CLASS_DEFAULT, nf_ct_l3num(ct),
                       &ct->tuplehash[!dir].tuple.src.u3,
                       &ct->tuplehash[!dir].tuple.dst.u3,
                       IPPROTO_UDP, NULL, &rtp_port);