Re: [PATCH net v3] netfilter: conntrack: avoid recursive master destruction

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Wed, Oct 07, 2026 at 10:48:48AM +0200, Florian Westphal wrote:
> Daehyeon Ko <4ncienth@gmail.com> wrote:
> > A conntrack holds a reference to its master. Userspace can build an
> > unbounded acyclic chain through ctnetlink. Expectation producers can do the
> > same: an nft ct expectation can attach its helper to an unconfirmed
> > expected child and arm the next expectation with that child as master. The
> > H.323 Q.931 helper can also propagate itself through call-forwarding
> > expectations.
> > 
> > When only child-held references remain, destroying the leaf calls
> > nf_ct_put() on its master. If that was the final reference, nf_ct_put()
> > recurses into nf_ct_destroy(). Repeating this at each level exhausts the
> > task stack and panics.
> > 
> > Nested expectations are existing helper semantics, and CTA_TUPLE_MASTER
> > was introduced for conntrackd state replication. Avoid per-producer
> > restrictions. Decrement the master's refcount directly, then free the
> > current conntrack. If the refcount reached zero, continue destroying the
> > master in the same invocation. This preserves existing constructors while
> > bounding stack use.
> > 
> > Fixes: 5faa1f4cb5a1 ("[NETFILTER]: nf_conntrack_netlink: add support to related connections")
> > Cc: stable@vger.kernel.org
> > Link: https://patch.msgid.link/179127347858.434549.11821822167265441355@kernel.org
> > Assisted-by: LLM
> > Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
> 
> Acked-by: Florian Westphal <fw@strlen.de>
> 
> That said, ignoring the source of the problem is not good.
> 
> I see no point whatsoever for a expected connection to have a
> non-control connection as its master.

I would prefer if chain length is limited too, ie. tighten this
interface based on the LLM feedback.