Netdev List
 help / color / mirror / Atom feed
From: Aaron Conole <aconole@redhat.com>
To: Ilya Maximets <i.maximets@ovn.org>
Cc: netdev@vger.kernel.org,  Pablo Neira Ayuso <pablo@netfilter.org>,
	Florian Westphal <fw@strlen.de>,  Phil Sutter <phil@nwl.cc>,
	 "David S. Miller" <davem@davemloft.net>,
	 Eric Dumazet <edumazet@google.com>,
	 Jakub Kicinski <kuba@kernel.org>,
	 Paolo Abeni <pabeni@redhat.com>,
	 Simon Horman <horms@kernel.org>,
	 Eelco Chaudron <echaudro@redhat.com>,
	 Jamal Hadi Salim <jhs@mojatatu.com>,
	 Jiri Pirko <jiri@resnulli.us>,  Xin Long <lucien.xin@gmail.com>,
	 Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>,
	 netfilter-devel@vger.kernel.org, coreteam@netfilter.org,
	 linux-kernel@vger.kernel.org, dev@openvswitch.org,
	 stable@vger.kernel.org
Subject: Re: [PATCH net 2/6] net: openvswitch: conntrack: remove 'add_helper' dead code
Date: Tue, 22 Sep 2026 11:26:43 -0400	[thread overview]
Message-ID: <f7tcxu5b93g.fsf@aconole-thinkpadt14gen4.rmtusnh.csb> (raw)
In-Reply-To: <20260921145655.3167436-3-i.maximets@ovn.org> (Ilya Maximets's message of "Mon, 21 Sep 2026 16:55:44 +0200")

Ilya Maximets <i.maximets@ovn.org> writes:

> This variable can only become 'true' when the connection is not
> confirmed, but it is only checked when it is confirmed.  So, it can be
> treated as being always false and just removed.
>
> Fixes: 3c1860543fcc ("openvswitch: add nf_ct_is_confirmed check before
> assigning the helper")
> Cc: stable@vger.kernel.org
> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
> ---
> @@ -821,13 +818,10 @@ static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
>  		}
>  
>  		/* Call the helper only if:
> -		 * - nf_conntrack_in() was executed above ("!cached") or a
> -		 *   helper was just attached ("add_helper") for a confirmed
> -		 *   connection, or
> +		 * - nf_conntrack_in() was executed above ("!cached"), or
>  		 * - When committing an unconfirmed connection.
>  		 */
> -		if ((nf_ct_is_confirmed(ct) ? !cached || add_helper :
> -					      info->commit)) {
> +		if ((nf_ct_is_confirmed(ct) ? !cached : info->commit)) {

This is already a good reason to apply - the existing construct wasn't
particularly friendly.  And the follow up in 3/6 is perfect.

>  			int err = nf_ct_helper(skb, ct, ctinfo, info->family);
>  
>  			err = verdict_to_errno(err);

Reviewed-by: Aaron Conole <aconole@redhat.com>


  parent reply	other threads:[~2026-09-22 15:26 UTC|newest]

Thread overview: 31+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-09-21 14:55 [PATCH net 0/6] ovs, net/sched: fixes for UAF after conntrack extension realloc Ilya Maximets
2026-09-21 14:55 ` [PATCH net 1/6] net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry Ilya Maximets
2026-09-22 14:58   ` netdev-bot+sashiko
2026-09-22 15:27     ` Ilya Maximets
2026-09-22 15:26   ` Aaron Conole
2026-09-21 14:55 ` [PATCH net 2/6] net: openvswitch: conntrack: remove 'add_helper' dead code Ilya Maximets
2026-09-22 14:58   ` netdev-bot+sashiko
2026-09-22 15:29     ` Ilya Maximets
2026-09-22 15:26   ` Aaron Conole [this message]
2026-09-21 14:55 ` [PATCH net 3/6] net: openvswitch: conntrack: fix helper UAF due to extensions realloc Ilya Maximets
2026-09-22 14:58   ` netdev-bot+sashiko
2026-09-22 15:43     ` Ilya Maximets
2026-09-22 15:26   ` Aaron Conole
2026-09-21 14:55 ` [PATCH net 4/6] net/sched: act_ct: avoid modifying shared unconfirmed ct entry Ilya Maximets
2026-09-22 14:58   ` netdev-bot+sashiko
2026-09-22 15:52     ` Ilya Maximets
2026-09-22 15:27   ` Aaron Conole
2026-09-22 20:42   ` Xin Long
2026-09-22 21:34   ` Jamal Hadi Salim
2026-09-21 14:55 ` [PATCH net 5/6] net/sched: act_ct: remove 'add_helper' dead code Ilya Maximets
2026-09-22 15:27   ` Aaron Conole
2026-09-22 20:43   ` Xin Long
2026-09-22 21:35   ` Jamal Hadi Salim
2026-09-21 14:55 ` [PATCH net 6/6] net/sched: act_ct: fix helper UAF due to extensions realloc Ilya Maximets
2026-09-22 14:58   ` netdev-bot+sashiko
2026-09-22 15:54     ` Ilya Maximets
2026-09-22 20:43   ` Xin Long
2026-09-22 21:36   ` Jamal Hadi Salim
2026-09-23 12:35   ` Aaron Conole
2026-09-24  1:21 ` [PATCH net 0/6] ovs, net/sched: fixes for UAF after conntrack extension realloc Jakub Kicinski
2026-09-24 17:10 ` patchwork-bot+netdevbpf

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=f7tcxu5b93g.fsf@aconole-thinkpadt14gen4.rmtusnh.csb \
    --to=aconole@redhat.com \
    --cc=coreteam@netfilter.org \
    --cc=davem@davemloft.net \
    --cc=dev@openvswitch.org \
    --cc=echaudro@redhat.com \
    --cc=edumazet@google.com \
    --cc=fw@strlen.de \
    --cc=horms@kernel.org \
    --cc=i.maximets@ovn.org \
    --cc=jhs@mojatatu.com \
    --cc=jiri@resnulli.us \
    --cc=kuba@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=lucien.xin@gmail.com \
    --cc=marcelo.leitner@gmail.com \
    --cc=netdev@vger.kernel.org \
    --cc=netfilter-devel@vger.kernel.org \
    --cc=pabeni@redhat.com \
    --cc=pablo@netfilter.org \
    --cc=phil@nwl.cc \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox