Re: [PATCH v4] netfilter: conntrack: fix integer overflow in expectation timeout

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Tue, May 19, 2026 at 09:55:06PM +0200, Pablo Neira Ayuso wrote:
> On Tue, May 19, 2026 at 09:38:12PM +0200, Florian Westphal wrote:
> > Àlex Fernández <tomaquet18@protonmail.com> wrote:
> > >  		x->timeout.expires = jiffies +
> > > -			ntohl(nla_get_be32(cda[CTA_EXPECT_TIMEOUT])) * HZ;
> > > +			(u64)ntohl(nla_get_be32(cda[CTA_EXPECT_TIMEOUT])) * HZ;
> 
> Yes, for correctness, fixing this is fine but...
> 
> > https://sashiko.dev/#/patchset/20260504112300.715192-1-tomaquet18%40protonmail.com
> > 
> > Does this fully resolve the overflow on 32-bit architectures?
> > The expires field in struct timer_list is an unsigned long, which is 32 bits
> > wide on 32-bit systems. Assigning the 64-bit multiplication result directly
> > to expires will silently truncate it back to 32 bits, causing the same
> > wraparound this patch intends to fix.
> > Additionally, does providing a timeout delta larger than INT_MAX break the
> > kernel's signed timer comparisons?
> > If the delta exceeds INT_MAX, macros like time_after() will evaluate the
> > timer as being in the past, causing it to expire immediately.
> 
> the submitter claims you can create expectations that expires
> inmediately, but what is the issue with this?
> 
> > Should the computed timeout delta be explicitly clamped to a safe maximum
> > (such as INT_MAX or MAX_JIFFY_OFFSET), similar to the logic used for
> > standard conntrack timeouts?
> 
> I think this is just a cleanup / nf-next material?

But this can also go through nf.git for correctness, we can just
describe in the PR the effect of this bug.