Re: [PATCH nft 1/2] netfilter: nf_conntrack_sip: fix missing expect put in REGISTER path

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Wed, May 06, 2026 at 03:33:12PM +0200, Florian Westphal wrote:
> Li Xiasong <lixiasong1@huawei.com> wrote:
> > process_register_request() allocates an expectation, but the !helper
> > error path returns NF_DROP without nf_ct_expect_put(exp).
> > 
> > Add the missing put to balance nf_ct_expect_alloc() on this path.
> > 
> > Fixes: e14575fa7529 ("netfilter: nf_conntrack: use rcu accessors where needed")
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Li Xiasong <lixiasong1@huawei.com>
> > ---
> >  net/netfilter/nf_conntrack_sip.c | 4 +++-
> >  1 file changed, 3 insertions(+), 1 deletion(-)
> > 
> > diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
> > index 1eb55907d470..a895bc836e1b 100644
> > --- a/net/netfilter/nf_conntrack_sip.c
> > +++ b/net/netfilter/nf_conntrack_sip.c
> > @@ -1377,8 +1377,10 @@ static int process_register_request(struct sk_buff *skb, unsigned int protoff,
> >  		saddr = &ct->tuplehash[!dir].tuple.src.u3;
> >  
> >  	helper = rcu_dereference(nfct_help(ct)->helper);
> > -	if (!helper)
> > +	if (!helper) {
> > +		nf_ct_expect_put(exp);
> >  		return NF_DROP;
> > +	}
> 
> I think it would be simpler to move the rcu defer to before
> exp allocation instead.

Agreed.