Re: [PATCH 5.15 336/570] netfilter: nf_conntrack_expect: skip expectations in other netns via proc

Harshit Mogalapalli
2026-04-15T11:16:28Z

Hi,

On 13/04/26 21:27, Greg Kroah-Hartman wrote:
> 5.15-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Pablo Neira Ayuso <pablo@netfilter.org>
>
> [ Upstream commit 3db5647984de03d9cae0dcddb509b058351f0ee4 ]
>
> Skip expectations that do not reside in this netns.
>
> Similar to e77e6ff502ea ("netfilter: conntrack: do not dump other netns's
> conntrack entries via proc").
>

AI assisted review spotted a probable issue: I have gone through the
analysis and the summary is:

I think this fix relies on commit: 02a3231b6d82 ("netfilter:
nf_conntrack_expect: store netns and zone in expectation")

This references commit explicitly states:
" This patch is required by the follow up fix not to dump expectations
that do not belong
to this netns." which is this patch.

Also part of patch series 4 and 5:
https://lore.kernel.org/all/20260320125947.305117-5-pablo@netfilter.org/

Given that we haven't taken 02a3231b6d82 ("netfilter:
nf_conntrack_expect: store netns and zone in expectation") to 5.15.y
should we drop this ?

Why ? Without it, the 5.15 backport still uses master-conntrack-derived
context instead of expectation-owned stored netns/zone state

i.e Upstream has:

possible_net_t net;

static inline struct net *nf_ct_exp_net(struct nf_conntrack_expect *exp)
{
return read_pnet(&exp->net);
}

Downstream has:

static inline struct net *nf_ct_exp_net(struct nf_conntrack_expect *exp)
{
return nf_ct_net(exp->master);
}

I don't know the internals of this fully, but looks like we might not
want to take this fix without 02a3231b6d82 ("netfilter:
nf_conntrack_expect: store netns and zone in expectation")

Thanks,
Harshit

> Fixes: 9b03f38d0487 ("netfilter: netns nf_conntrack: per-netns expectations")
> Signed-off-by: Florian Westphal <fw@strlen.de>
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
> net/netfilter/nf_conntrack_expect.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
> index 6d056ebba57c6..10d4dfbdde226 100644
> --- a/net/netfilter/nf_conntrack_expect.c
> +++ b/net/netfilter/nf_conntrack_expect.c
> @@ -627,11 +627,15 @@ static int exp_seq_show(struct seq_file *s, void *v)
> {
> struct nf_conntrack_expect *expect;
> struct nf_conntrack_helper *helper;
> + struct net *net = seq_file_net(s);
> struct hlist_node *n = v;
> char *delim = "";
>
> expect = hlist_entry(n, struct nf_conntrack_expect, hnode);
>
> + if (!net_eq(nf_ct_exp_net(expect), net))
> + return 0;
> +
> if (expect->timeout.function)
> seq_printf(s, "%ld ", timer_pending(&expect->timeout)
> ? (long)(expect->timeout.expires - jiffies)/HZ : 0);