Re: [PATCH net-next 01/12] netfilter: add DEBUG_NET_WARN_ON_ONCE to skb_set_nfct()

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Tue, Aug 11, 2026 at 06:34:41PM -0700, Jakub Kicinski wrote:
> This is an AI-generated review of your patch. The human sending this
> email has considered the AI review valid, or at least plausible.
> ---
> netfilter: add DEBUG_NET_WARN_ON_ONCE to skb_set_nfct()
> 
> This adds a DEBUG_NET_WARN_ON_ONCE() to skb_set_nfct() that fires when
> skb->_nfct already holds a conntrack pointer, so that nf_ct_set() calls
> overwriting a live ct object are caught.  Several existing nf_ct_set()
> callers in ipvs, conntrack clash resolution, openvswitch and act_ct are
> converted to call nf_reset_ct() first.
> 
> > diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
> > index 22eda1d54a0e8..95184183180f6 100644
> > --- a/include/linux/skbuff.h
> > +++ b/include/linux/skbuff.h
> > @@ -5004,6 +5004,7 @@ static inline unsigned long skb_get_nfct(const struct sk_buff *skb)
> >  static inline void skb_set_nfct(struct sk_buff *skb, unsigned long nfct)
> >  {
> >  #if IS_ENABLED(CONFIG_NF_CONNTRACK)
> > +	DEBUG_NET_WARN_ON_ONCE(skb->_nfct & NFCT_PTRMASK);
> >  	skb->slow_gro |= !!nfct;
> >  	skb->_nfct = nfct;
> >  #endif
> 
> [Severity: High]
> Was nf_ct_bridge_pre() in net/bridge/netfilter/nf_conntrack_bridge.c meant
> to be converted too?

This particular issue is fixed in the nf.git PR.


BTW, I can see these reports from here:

https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260810194015.932627-1-pablo%40netfilter.org

Thanks.