Re: [PATCH net v3] netfilter: conntrack: avoid recursive master destruction

[Florian Westphal <fw@strlen.de>]

Daehyeon Ko <4ncienth@gmail.com> wrote:
> A conntrack holds a reference to its master. Userspace can build an
> unbounded acyclic chain through ctnetlink. Expectation producers can do the
> same: an nft ct expectation can attach its helper to an unconfirmed
> expected child and arm the next expectation with that child as master. The
> H.323 Q.931 helper can also propagate itself through call-forwarding
> expectations.
> 
> When only child-held references remain, destroying the leaf calls
> nf_ct_put() on its master. If that was the final reference, nf_ct_put()
> recurses into nf_ct_destroy(). Repeating this at each level exhausts the
> task stack and panics.
> 
> Nested expectations are existing helper semantics, and CTA_TUPLE_MASTER
> was introduced for conntrackd state replication. Avoid per-producer
> restrictions. Decrement the master's refcount directly, then free the
> current conntrack. If the refcount reached zero, continue destroying the
> master in the same invocation. This preserves existing constructors while
> bounding stack use.
> 
> Fixes: 5faa1f4cb5a1 ("[NETFILTER]: nf_conntrack_netlink: add support to related connections")
> Cc: stable@vger.kernel.org
> Link: https://patch.msgid.link/179127347858.434549.11821822167265441355@kernel.org
> Assisted-by: LLM
> Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>

Acked-by: Florian Westphal <fw@strlen.de>

That said, ignoring the source of the problem is not good.

I see no point whatsoever for a expected connection to have a
non-control connection as its master.