Re: [PATCH nf] netfilter: nf_conntrack_expect: zero at allocation time

[Florian Westphal <fw@strlen.de>]

Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> On Thu, Jun 25, 2026 at 02:13:53AM +0200, Florian Westphal wrote:
> > There are occasional LLM hints wrt. leaking uninitialized data to
> > userspace via ctnetlink.  Just zero at allocation time, expectations are
> > not frequently used these days.
> 
> Fine with me. IIRC hints came because of real issue, ie. paths where
> I was missing to initial something.


> > @@ -389,6 +389,7 @@ void nf_ct_expect_init(struct nf_conntrack_expect *exp, unsigned int class,
> >  #if IS_ENABLED(CONFIG_NF_NAT)
> >  	memset(&exp->saved_addr, 0, sizeof(exp->saved_addr));
> >  	memset(&exp->saved_proto, 0, sizeof(exp->saved_proto));
> > +	exp->dir = 0;
> 
> Hm. But now area is expect is zeroed, right?
> 
> Maybe nf_ct_expect_init() needs to be updated to remove needless
> zeroing too?

See:
> > Intentionally keeps _init as-is because we could theoretically support
> > re-init, so add the missing exp->dir there.

If you say we are guaranteed to always have:

exp = nf_ct_expect_alloc(ct);
nf_ct_expect_init(exp)

then we could remove it.  But then I'd question why we even have this
alloc / init split and not:

exp = nf_ct_expect_new(rtp_exp, NF_CT_EXPECT_CLASS_DEFAULT, nf_ct_l3num(ct),
                       &ct->tuplehash[!dir].tuple.src.u3,
                       &ct->tuplehash[!dir].tuple.dst.u3,
                       IPPROTO_UDP, NULL, &rtp_port);