Re: [PATCH net 10/14] netfilter: ctnetlink: ensure safe access to master conntrack

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Wed, Mar 25, 2026 at 06:26:58PM +0100, Pablo Neira Ayuso wrote:
> Hi Florian,
> 
> Sorry for this late followup incremental fix.
> 
> On Wed, Mar 25, 2026 at 02:11:04PM +0100, Florian Westphal wrote:
> > From: Pablo Neira Ayuso <pablo@netfilter.org>
> > 
> > Holding reference on the expectation is not sufficient, the master
> > conntrack object can just go away, making exp->master invalid.
> 
> This patch needs this update for expectations which do not have
> nfct_help(ct), two cases:
> 
> - nft_ct creates
> - ip_vs_ftp
> 
> See attached incremental patch.

Sorry. Actually, This incremental fix is for:

  [PATCH net 08/14] netfilter: nf_conntrack_expect: honor expectation helper field

for the two cases I mentioned above.

> diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
> index 509d3eb6f56a..cf39662c4b97 100644
> --- a/net/netfilter/nf_conntrack_expect.c
> +++ b/net/netfilter/nf_conntrack_expect.c
> @@ -325,7 +325,9 @@ void nf_ct_expect_init(struct nf_conntrack_expect *exp, unsigned int class,
>  		       u_int8_t proto, const __be16 *src, const __be16 *dst)
>  {
>  	struct net *net = read_pnet(&exp->master->ct_net);
> -
> +	struct nf_conntrack_helper *helper;
> +	struct nf_conn *ct = exp->master;
> +	struct nf_conn_help *help;
>  	int len;
>  
>  	if (family == AF_INET)
> @@ -336,7 +338,14 @@ void nf_ct_expect_init(struct nf_conntrack_expect *exp, unsigned int class,
>  	exp->flags = 0;
>  	exp->class = class;
>  	exp->expectfn = NULL;
> -	rcu_assign_pointer(exp->helper, nfct_help(exp->master)->helper);
> +	help = nfct_help(ct);
> +	if (help) {
> +		helper = rcu_dereference(help->helper);
> +		if (helper)
> +			rcu_assign_pointer(exp->helper, help->helper);
> +	} else {
> +		exp->helper = NULL;
> +	}
>  	write_pnet(&exp->net, net);
>  	exp->zone = exp->master->zone;
>  	exp->tuple.src.l3num = family;