Re: [PATCH nf] netfilter: nf_conntrack_expect: zero at allocation time

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Thu, Jun 25, 2026 at 02:13:53AM +0200, Florian Westphal wrote:
> There are occasional LLM hints wrt. leaking uninitialized data to
> userspace via ctnetlink.  Just zero at allocation time, expectations are
> not frequently used these days.

Fine with me. IIRC hints came because of real issue, ie. paths where
I was missing to initial something.

> Intentionally keeps _init as-is because we could theoretically support
> re-init, so add the missing exp->dir there.
> 
> Signed-off-by: Florian Westphal <fw@strlen.de>
> ---
>  net/netfilter/nf_conntrack_expect.c  |  3 ++-
>  net/netfilter/nf_conntrack_netlink.c | 11 +----------
>  2 files changed, 3 insertions(+), 11 deletions(-)
> 
> diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
> index 49e18eda037e..0b213ffc0378 100644
> --- a/net/netfilter/nf_conntrack_expect.c
> +++ b/net/netfilter/nf_conntrack_expect.c
> @@ -306,7 +306,7 @@ struct nf_conntrack_expect *nf_ct_expect_alloc(struct nf_conn *me)
>  {
>  	struct nf_conntrack_expect *new;
>  
> -	new = kmem_cache_alloc(nf_ct_expect_cachep, GFP_ATOMIC);
> +	new = kmem_cache_zalloc(nf_ct_expect_cachep, GFP_ATOMIC);
>  	if (!new)
>  		return NULL;
>  
> @@ -389,6 +389,7 @@ void nf_ct_expect_init(struct nf_conntrack_expect *exp, unsigned int class,
>  #if IS_ENABLED(CONFIG_NF_NAT)
>  	memset(&exp->saved_addr, 0, sizeof(exp->saved_addr));
>  	memset(&exp->saved_proto, 0, sizeof(exp->saved_proto));
> +	exp->dir = 0;

Hm. But now area is expect is zeroed, right?

Maybe nf_ct_expect_init() needs to be updated to remove needless
zeroing too?

Thanks!

>  #endif
>  }
>  EXPORT_SYMBOL_GPL(nf_ct_expect_init);
> diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
> index 4e78d2482989..c6daeea35044 100644
> --- a/net/netfilter/nf_conntrack_netlink.c
> +++ b/net/netfilter/nf_conntrack_netlink.c
> @@ -3565,8 +3565,6 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct,
>  	if (cda[CTA_EXPECT_FLAGS]) {
>  		exp->flags = ntohl(nla_get_be32(cda[CTA_EXPECT_FLAGS]));
>  		exp->flags &= ~NF_CT_EXPECT_USERSPACE;
> -	} else {
> -		exp->flags = 0;
>  	}
>  	if (cda[CTA_EXPECT_FN]) {
>  		const char *name = nla_data(cda[CTA_EXPECT_FN]);
> @@ -3578,8 +3576,7 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct,
>  			goto err_out;
>  		}
>  		exp->expectfn = expfn->expectfn;
> -	} else
> -		exp->expectfn = NULL;
> +	}
>  
>  	exp->class = class;
>  	exp->master = ct;
> @@ -3598,12 +3595,6 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct,
>  						 exp, nf_ct_l3num(ct));
>  		if (err < 0)
>  			goto err_out;
> -#if IS_ENABLED(CONFIG_NF_NAT)
> -	} else {
> -		memset(&exp->saved_addr, 0, sizeof(exp->saved_addr));
> -		memset(&exp->saved_proto, 0, sizeof(exp->saved_proto));
> -		exp->dir = 0;
> -#endif
>  	}
>  	return exp;
>  err_out:
> -- 
> 2.53.0
> 
>