Re: [PATCH v4] netfilter: conntrack: fix integer overflow in expectation timeout

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Tue, May 19, 2026 at 09:38:12PM +0200, Florian Westphal wrote:
> Àlex Fernández <tomaquet18@protonmail.com> wrote:
> >  		x->timeout.expires = jiffies +
> > -			ntohl(nla_get_be32(cda[CTA_EXPECT_TIMEOUT])) * HZ;
> > +			(u64)ntohl(nla_get_be32(cda[CTA_EXPECT_TIMEOUT])) * HZ;

Yes, for correctness, fixing this is fine but...

> https://sashiko.dev/#/patchset/20260504112300.715192-1-tomaquet18%40protonmail.com
> 
> Does this fully resolve the overflow on 32-bit architectures?
> The expires field in struct timer_list is an unsigned long, which is 32 bits
> wide on 32-bit systems. Assigning the 64-bit multiplication result directly
> to expires will silently truncate it back to 32 bits, causing the same
> wraparound this patch intends to fix.
> Additionally, does providing a timeout delta larger than INT_MAX break the
> kernel's signed timer comparisons?
> If the delta exceeds INT_MAX, macros like time_after() will evaluate the
> timer as being in the past, causing it to expire immediately.

the submitter claims you can create expectations that expires
inmediately, but what is the issue with this?

> Should the computed timeout delta be explicitly clamped to a safe maximum
> (such as INT_MAX or MAX_JIFFY_OFFSET), similar to the logic used for
> standard conntrack timeouts?

I think this is just a cleanup / nf-next material?