Re: [PATCH nf] netfilter: nf_conntrack: move expectation hlist_head on ct extension realloc

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Wed, Jul 29, 2026 at 02:16:45AM +0200, Pablo Neira Ayuso wrote:
> Commit 7c9664351980 ("netfilter: move nat hlist_head to nf_conn") moved
> the nat hlist_head to nf_conn and it removes the .move callback for ct
> extensions. This commit description already points to the same problem
> that is being addressed for expectations by this patch:
> 
>  1. ...
>  2. When reallocation of extension area occurs we need to fixup the
>     bysource hash head via hlist_replace_rcu.
> 
> This means that the .pprev pointer of the first expectation might refer
> to a stale hlist_head after reallocation.
> 
> This bug is now easier to trigger since the introduction of the commit
> 857b46027d6f ("netfilter: nft_ct: add ct expectations support") which
> allows to create expectations before the ct extension area have been
> fully set up for unconfirmed conntracks.
> 
> This patch uses hlist_move_list() because this conntrack is unconfirmed,
> ie. not yet in the hashes, and it is neither visible to the conntrack
> garbage collector nor ctnetlink.

Scratch this iteration, ctnetlink_del_expect() can reach the
expectation.