diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2026-08-05 23:16:34 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2026-08-10 13:01:37 +0200 |
| commit | 5546b082fa7c58dd0d0d2a694c12098764645765 (patch) | |
| tree | 5d9628701855eae23193fd33e73f0847cf10a74b /include | |
| parent | 001b5d347d8ba39b2dccaefcc57967b18caec8fe (diff) | |
netfilter: add DEBUG_NET_WARN_ON_ONCE to skb_set_nfct()
Trigger a warning if nf_ct_set() overlaps an existing ct object leading
to refcount leak. Add this warning to skb_set_nfct() whose only user is
nf_ct_set() instead.
Update existing nf_ct_set() callers to use nf_reset_ct() first to clean
up stale pointer to conntrack object which migh trigger false positive
warnings.
Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'include')
| -rw-r--r-- | include/linux/skbuff.h | 1 | ||||
| -rw-r--r-- | include/net/ip_vs.h | 2 |
2 files changed, 2 insertions, 1 deletions
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h index 22eda1d54a0e..95184183180f 100644 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@ -5004,6 +5004,7 @@ static inline unsigned long skb_get_nfct(const struct sk_buff *skb) static inline void skb_set_nfct(struct sk_buff *skb, unsigned long nfct) { #if IS_ENABLED(CONFIG_NF_CONNTRACK) + DEBUG_NET_WARN_ON_ONCE(skb->_nfct & NFCT_PTRMASK); skb->slow_gro |= !!nfct; skb->_nfct = nfct; #endif diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h index b3bb228ad75c..3dca7d387dd0 100644 --- a/include/net/ip_vs.h +++ b/include/net/ip_vs.h @@ -2121,7 +2121,7 @@ static inline void ip_vs_notrack(struct sk_buff *skb) struct nf_conn *ct = nf_ct_get(skb, &ctinfo); if (ct) { - nf_conntrack_put(&ct->ct_general); + nf_reset_ct(skb); nf_ct_set(skb, NULL, IP_CT_UNTRACKED); } #endif |