Re: [PATCH net 10/14] netfilter: ctnetlink: ensure safe access to master conntrack

[Pablo Neira Ayuso <pablo@netfilter.org>]

[-- Attachment #1: Type: text/plain, Size: 465 bytes --]

Hi Florian,

Sorry for this late followup incremental fix.

On Wed, Mar 25, 2026 at 02:11:04PM +0100, Florian Westphal wrote:
> From: Pablo Neira Ayuso <pablo@netfilter.org>
> 
> Holding reference on the expectation is not sufficient, the master
> conntrack object can just go away, making exp->master invalid.

This patch needs this update for expectations which do not have
nfct_help(ct), two cases:

- nft_ct creates
- ip_vs_ftp

See attached incremental patch.

[-- Attachment #2: fix.patch --]
[-- Type: text/x-diff, Size: 1079 bytes --]

diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index 509d3eb6f56a..cf39662c4b97 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -325,7 +325,9 @@ void nf_ct_expect_init(struct nf_conntrack_expect *exp, unsigned int class,
 		       u_int8_t proto, const __be16 *src, const __be16 *dst)
 {
 	struct net *net = read_pnet(&exp->master->ct_net);
-
+	struct nf_conntrack_helper *helper;
+	struct nf_conn *ct = exp->master;
+	struct nf_conn_help *help;
 	int len;
 
 	if (family == AF_INET)
@@ -336,7 +338,14 @@ void nf_ct_expect_init(struct nf_conntrack_expect *exp, unsigned int class,
 	exp->flags = 0;
 	exp->class = class;
 	exp->expectfn = NULL;
-	rcu_assign_pointer(exp->helper, nfct_help(exp->master)->helper);
+	help = nfct_help(ct);
+	if (help) {
+		helper = rcu_dereference(help->helper);
+		if (helper)
+			rcu_assign_pointer(exp->helper, help->helper);
+	} else {
+		exp->helper = NULL;
+	}
 	write_pnet(&exp->net, net);
 	exp->zone = exp->master->zone;
 	exp->tuple.src.l3num = family;