Re: [PATCH net] netfilter: conntrack: avoid recursive master destruction

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Thu, Oct 01, 2026 at 09:19:15PM +0200, Florian Westphal wrote:
> Daehyeon Ko <4ncienth@gmail.com> wrote:
> > Conntrack entries created through ctnetlink can reference another
> > confirmed entry as their master.  There is no limit on the resulting
> > chain depth.
> 
> I don't think this should be allowed.  I.e. (totally untested):
> 
> diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
> --- a/net/netfilter/nf_conntrack_netlink.c
> +++ b/net/netfilter/nf_conntrack_netlink.c
> @@ -2359,6 +2359,12 @@ ctnetlink_create_conntrack(struct net *net,
>                         goto err2;
>                 }
>                 master_ct = nf_ct_tuplehash_to_ctrack(master_h);
> +               if (master_ct->master) {
> +                       nf_ct_put(master_ct);
> +                       err = -EOPNOTSUPP;
> +                       goto err2;
> +               }

Agreed. Thanks.

> +
>                 __set_bit(IPS_EXPECTED_BIT, &ct->status);
>                 ct->master = master_ct;