Re: Backport request: "netfilter: nf_conntrack_expect: restore helper propagation via expectation"

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Wed, Jul 29, 2026 at 11:38:17PM +0200, Ilya Maximets wrote:
> Hi.  The mentioned commit dcb0f9aefdd604d36710fda53c25bd7cf4a3e37a
> was backported to 7.0, but not further, while two commits it is fixing
> were backported down to 6.1.
> 
> Admittedly, the patch is not very important as far as functionality
> goes (at least for FTP), but the issue does change the user visible
> behavior and that makes all the FTP system tests in openvswitch
> project (in userspace) to fail.  This makes it harder to validate OVS
> on kernels below 7.0 and makes it unnecessarily harder to validate
> changes for the openvswitch kernel module on stable kernels.
> 
> So, it would be really nice to have the fix backported to the same
> branches where the commits it fixes were (6.1).
> 
> AFAICT, cherry-pick works without conflicts down to 6.6.  For 6.1
> there is a minor conflict, 6.1.y has the extra debug message:
> 
> diff --cc net/netfilter/nf_conntrack_core.c
> index f5c466ea1e7d,8ba5b22a1eef..000000000000
> --- a/net/netfilter/nf_conntrack_core.c
> +++ b/net/netfilter/nf_conntrack_core.c
> @@@ -1800,8 -1811,8 +1800,10 @@@ init_conntrack(struct net *net, struct 
>   		spin_lock_bh(&nf_conntrack_expect_lock);
>   		exp = nf_ct_find_expectation(net, zone, tuple, !tmpl || nf_ct_is_confirmed(tmpl));
>   		if (exp) {
> + 			struct nf_conntrack_helper *assign_helper;
> + 
>  +			pr_debug("expectation arrives ct=%p exp=%p\n",
>  +				 ct, exp);
>   			/* Welcome, Mr. Bond.  We've been expecting you... */
>   			__set_bit(IPS_EXPECTED_BIT, &ct->status);
>   			/* exp->master safe, refcnt bumped in nf_ct_find_expectation */
> ---
> 
> WDYT?

I am fine with getting dcb0f9aefdd604d36710fda53c25bd7cf4a3e37a into
-stable release < 7.0 if that is what you mean.