Re: [PATCH 5.15 336/570] netfilter: nf_conntrack_expect: skip expectations in other netns via proc

Pablo Neira Ayuso
2026-04-15T11:20:52Z

On Wed, Apr 15, 2026 at 04:45:49PM +0530, Harshit Mogalapalli wrote:
> Hi,
>
> On 13/04/26 21:27, Greg Kroah-Hartman wrote:
> > 5.15-stable review patch. If anyone has any objections, please let me know.
> >
> > ------------------
> >
> > From: Pablo Neira Ayuso <pablo@netfilter.org>
> >
> > [ Upstream commit 3db5647984de03d9cae0dcddb509b058351f0ee4 ]
> >
> > Skip expectations that do not reside in this netns.
> >
> > Similar to e77e6ff502ea ("netfilter: conntrack: do not dump other netns's
> > conntrack entries via proc").
> >
>
> AI assisted review spotted a probable issue: I have gone through the
> analysis and the summary is:
>
> I think this fix relies on commit: 02a3231b6d82 ("netfilter:
> nf_conntrack_expect: store netns and zone in expectation")
>
> This references commit explicitly states:
> " This patch is required by the follow up fix not to dump expectations that
> do not belong
> to this netns." which is this patch.
>
>
> Also part of patch series 4 and 5:
> https://lore.kernel.org/all/20260320125947.305117-5-pablo@netfilter.org/
>
> Given that we haven't taken 02a3231b6d82 ("netfilter: nf_conntrack_expect:
> store netns and zone in expectation") to 5.15.y should we drop this ?
>
> Why ? Without it, the 5.15 backport still uses master-conntrack-derived
> context instead of expectation-owned stored netns/zone state
>
> i.e Upstream has:
>
> possible_net_t net;
>
> static inline struct net *nf_ct_exp_net(struct nf_conntrack_expect *exp)
> {
> return read_pnet(&exp->net);
> }
>
> Downstream has:
>
> static inline struct net *nf_ct_exp_net(struct nf_conntrack_expect *exp)
> {
> return nf_ct_net(exp->master);
> }
>
>
> I don't know the internals of this fully, but looks like we might not want
> to take this fix without 02a3231b6d82 ("netfilter: nf_conntrack_expect:
> store netns and zone in expectation")

Yes:

02a3231b6d82 ("netfilter: nf_conntrack_expect: store netns and zone in expectation")

is good to have as a Stable-Dep.

> Thanks,
> Harshit
>
>
>
>
>
>
> > Fixes: 9b03f38d0487 ("netfilter: netns nf_conntrack: per-netns expectations")
> > Signed-off-by: Florian Westphal <fw@strlen.de>
> > Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> > Signed-off-by: Sasha Levin <sashal@kernel.org>
> > ---
> > net/netfilter/nf_conntrack_expect.c | 4 ++++
> > 1 file changed, 4 insertions(+)
> >
> > diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
> > index 6d056ebba57c6..10d4dfbdde226 100644
> > --- a/net/netfilter/nf_conntrack_expect.c
> > +++ b/net/netfilter/nf_conntrack_expect.c
> > @@ -627,11 +627,15 @@ static int exp_seq_show(struct seq_file *s, void *v)
> > {
> > struct nf_conntrack_expect *expect;
> > struct nf_conntrack_helper *helper;
> > + struct net *net = seq_file_net(s);
> > struct hlist_node *n = v;
> > char *delim = "";
> > expect = hlist_entry(n, struct nf_conntrack_expect, hnode);
> > + if (!net_eq(nf_ct_exp_net(expect), net))
> > + return 0;
> > +
> > if (expect->timeout.function)
> > seq_printf(s, "%ld ", timer_pending(&expect->timeout)
> > ? (long)(expect->timeout.expires - jiffies)/HZ : 0);
>