Re: Backport request: "netfilter: nf_conntrack_expect: restore helper propagation via expectation"

[Greg KH <greg@kroah.com>]

On Thu, Jul 30, 2026 at 01:07:39AM +0200, Pablo Neira Ayuso wrote:
> On Wed, Jul 29, 2026 at 11:38:17PM +0200, Ilya Maximets wrote:
> > Hi.  The mentioned commit dcb0f9aefdd604d36710fda53c25bd7cf4a3e37a
> > was backported to 7.0, but not further, while two commits it is fixing
> > were backported down to 6.1.
> > 
> > Admittedly, the patch is not very important as far as functionality
> > goes (at least for FTP), but the issue does change the user visible
> > behavior and that makes all the FTP system tests in openvswitch
> > project (in userspace) to fail.  This makes it harder to validate OVS
> > on kernels below 7.0 and makes it unnecessarily harder to validate
> > changes for the openvswitch kernel module on stable kernels.
> > 
> > So, it would be really nice to have the fix backported to the same
> > branches where the commits it fixes were (6.1).
> > 
> > AFAICT, cherry-pick works without conflicts down to 6.6.  For 6.1
> > there is a minor conflict, 6.1.y has the extra debug message:
> > 
> > diff --cc net/netfilter/nf_conntrack_core.c
> > index f5c466ea1e7d,8ba5b22a1eef..000000000000
> > --- a/net/netfilter/nf_conntrack_core.c
> > +++ b/net/netfilter/nf_conntrack_core.c
> > @@@ -1800,8 -1811,8 +1800,10 @@@ init_conntrack(struct net *net, struct 
> >   		spin_lock_bh(&nf_conntrack_expect_lock);
> >   		exp = nf_ct_find_expectation(net, zone, tuple, !tmpl || nf_ct_is_confirmed(tmpl));
> >   		if (exp) {
> > + 			struct nf_conntrack_helper *assign_helper;
> > + 
> >  +			pr_debug("expectation arrives ct=%p exp=%p\n",
> >  +				 ct, exp);
> >   			/* Welcome, Mr. Bond.  We've been expecting you... */
> >   			__set_bit(IPS_EXPECTED_BIT, &ct->status);
> >   			/* exp->master safe, refcnt bumped in nf_ct_find_expectation */
> > ---
> > 
> > WDYT?
> 
> I am fine with getting dcb0f9aefdd604d36710fda53c25bd7cf4a3e37a into
> -stable release < 7.0 if that is what you mean.
> 

Great, can someone send us properly backported/tested patches to apply?

thanks,

greg k-h