From: Florian Westphal <fw@strlen.de>
To: Zihan Xi <zihanx@nebusec.ai>
Cc: netfilter-devel@vger.kernel.org, pablo@netfilter.org,
phil@nwl.cc, davem@davemloft.net, edumazet@google.com,
pabeni@redhat.com, horms@kernel.org, avagin@gmail.com,
vega@nebusec.ai
Subject: Re: [PATCH nf v2 1/2] netfilter: nf_conntrack_tcp: defer timeout-lowering invalid log until after unlock
Date: Thu, 30 Jul 2026 22:25:22 +0200 [thread overview]
Message-ID: <amuzMlprGP13tg1L@strlen.de> (raw)
In-Reply-To: <e387bc8da39f47fe48fddb576125805273a9a48d.1785348197.git.zihanx@nebusec.ai>
Zihan Xi <zihanx@nebusec.ai> wrote:
> nf_tcp_handle_invalid() can lower the timeout of an assured TCP
> conntrack when an out-of-window FIN/RST is answered from the other
> direction. Today it also logs that event while ct->lock is still held.
>
> If invalid logging is routed to nfnetlink_log and conntrack export is
> enabled, the log path can re-enter conntrack netlink glue and recurse
> into tcp_to_nlattr() on the same conntrack. Move this timeout-lowering
> log emission out from under ct->lock by making nf_tcp_handle_invalid()
> return whether logging is needed, then emit the message after unlocking.
>
> Keep the timeout update unchanged and simplify the log text so this path
> does not need to stash extra state while the lock is held.
Reviewed-by: Florian Westphal <fw@strlen.de>
But consider following up on nf_conntrack_proto_sctp.c.
next prev parent reply other threads:[~2026-07-30 20:25 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-30 13:55 [PATCH nf v2 0/2] netfilter: fix TCP conntrack invalid-log deadlock Zihan Xi
2026-07-30 13:55 ` [PATCH nf v2 1/2] netfilter: nf_conntrack_tcp: defer timeout-lowering invalid log until after unlock Zihan Xi
2026-07-30 20:25 ` Florian Westphal [this message]
2026-07-30 13:55 ` [PATCH nf v2 2/2] netfilter: nf_conntrack_tcp: defer tcp_in_window invalid logging " Zihan Xi
2026-07-30 20:28 ` Florian Westphal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=amuzMlprGP13tg1L@strlen.de \
--to=fw@strlen.de \
--cc=avagin@gmail.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=horms@kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=pablo@netfilter.org \
--cc=phil@nwl.cc \
--cc=vega@nebusec.ai \
--cc=zihanx@nebusec.ai \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.