diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2026-08-05 23:16:34 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2026-08-10 13:01:37 +0200 |
| commit | 5546b082fa7c58dd0d0d2a694c12098764645765 (patch) | |
| tree | 5d9628701855eae23193fd33e73f0847cf10a74b /include/linux | |
| parent | 001b5d347d8ba39b2dccaefcc57967b18caec8fe (diff) | |
netfilter: add DEBUG_NET_WARN_ON_ONCE to skb_set_nfct()
Trigger a warning if nf_ct_set() overlaps an existing ct object leading
to refcount leak. Add this warning to skb_set_nfct() whose only user is
nf_ct_set() instead.
Update existing nf_ct_set() callers to use nf_reset_ct() first to clean
up stale pointer to conntrack object which migh trigger false positive
warnings.
Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'include/linux')
| -rw-r--r-- | include/linux/skbuff.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h index 22eda1d54a0e..95184183180f 100644 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@ -5004,6 +5004,7 @@ static inline unsigned long skb_get_nfct(const struct sk_buff *skb) static inline void skb_set_nfct(struct sk_buff *skb, unsigned long nfct) { #if IS_ENABLED(CONFIG_NF_CONNTRACK) + DEBUG_NET_WARN_ON_ONCE(skb->_nfct & NFCT_PTRMASK); skb->slow_gro |= !!nfct; skb->_nfct = nfct; #endif |