Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/2216146/?format=api
{ "id": 2216146, "url": "http://patchwork.ozlabs.org/api/patches/2216146/?format=api", "web_url": "http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260325222615.637793-10-pablo@netfilter.org/", "project": { "id": 26, "url": "http://patchwork.ozlabs.org/api/projects/26/?format=api", "name": "Netfilter Development", "link_name": "netfilter-devel", "list_id": "netfilter-devel.vger.kernel.org", "list_email": "netfilter-devel@vger.kernel.org", "web_url": null, "scm_url": null, "webscm_url": null, "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<20260325222615.637793-10-pablo@netfilter.org>", "list_archive_url": null, "date": "2026-03-25T22:26:10", "name": "[net,09/14] netfilter: nf_conntrack_expect: use expect->helper", "commit_ref": null, "pull_url": null, "state": "handled-elsewhere", "archived": true, "hash": "4eece697ca84fbfe821787e5c56f06c1ededc921", "submitter": { "id": 1315, "url": "http://patchwork.ozlabs.org/api/people/1315/?format=api", "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260325222615.637793-10-pablo@netfilter.org/mbox/", "series": [ { "id": 497517, "url": "http://patchwork.ozlabs.org/api/series/497517/?format=api", "web_url": "http://patchwork.ozlabs.org/project/netfilter-devel/list/?series=497517", "date": "2026-03-25T22:26:01", "name": "[net,01/14] netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry", "version": 2, "mbox": "http://patchwork.ozlabs.org/series/497517/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2216146/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2216146/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "\n <netfilter-devel+bounces-11429-incoming=patchwork.ozlabs.org@vger.kernel.org>", "X-Original-To": [ "incoming@patchwork.ozlabs.org", "netfilter-devel@vger.kernel.org" ], "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=netfilter.org header.i=@netfilter.org\n header.a=rsa-sha256 header.s=2025 header.b=mScutKAT;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c04:e001:36c::12fc:5321; helo=tor.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-11429-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)", "smtp.subspace.kernel.org;\n\tdkim=pass (2048-bit key) header.d=netfilter.org header.i=@netfilter.org\n header.b=\"mScutKAT\"", "smtp.subspace.kernel.org;\n arc=none smtp.client-ip=217.70.190.124", "smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=netfilter.org", "smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=netfilter.org" ], "Received": [ "from tor.lore.kernel.org (tor.lore.kernel.org\n [IPv6:2600:3c04:e001:36c::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fh1kF1J94z1y1x\n\tfor <incoming@patchwork.ozlabs.org>; Thu, 26 Mar 2026 09:27:33 +1100 (AEDT)", "from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby tor.lore.kernel.org (Postfix) with ESMTP id 71C473063AEF\n\tfor <incoming@patchwork.ozlabs.org>; Wed, 25 Mar 2026 22:26:51 +0000 (UTC)", "from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id 4832B36D9F1;\n\tWed, 25 Mar 2026 22:26:39 +0000 (UTC)", "from mail.netfilter.org (mail.netfilter.org [217.70.190.124])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id 2F27D37B021;\n\tWed, 25 Mar 2026 22:26:37 +0000 (UTC)", "from localhost.localdomain (mail-agni [217.70.190.124])\n\tby mail.netfilter.org (Postfix) with ESMTPSA id 13EE760254;\n\tWed, 25 Mar 2026 23:26:35 +0100 (CET)" ], "ARC-Seal": "i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1774477598; cv=none;\n b=ioswWVsaG617np2xpq9o7pAixUxPZWRJUIpLq7iTgn0Va7LGMTvrVKMo0Cdp58XwKT/33HHCSeq7mYlzwuyNJFdgZ2QG8+whlF2J2+R85+8QXS0qToM0k7eBSsS781xv3/YUAm69p6rp20lPaj0ZpmSsmzIqqs7ucZucTssd22s=", "ARC-Message-Signature": "i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1774477598; c=relaxed/simple;\n\tbh=oTUeYgRYY4NGUxknfj9KSKHk9yYz1i9WzvwY/W4UwCU=;\n\th=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:\n\t MIME-Version;\n b=E/A1uwz6GgBaKvjXvLhSIr5h8tiaD0pBAOjWxNDVAJsAbcxFYutRAzZV6IRF9xRAfck2FueEZeqt1npFBRkS76ppP2VKi2TCnUyH4+VQvsYO7sxzBtWzZWhId/hf6n65CofKaRKe3RzCQ0x3ZY3k9uptNKYa745UPxVwGoC0Jgw=", "ARC-Authentication-Results": "i=1; smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=netfilter.org;\n spf=pass smtp.mailfrom=netfilter.org;\n dkim=pass (2048-bit key) header.d=netfilter.org header.i=@netfilter.org\n header.b=mScutKAT; arc=none smtp.client-ip=217.70.190.124", "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=netfilter.org;\n\ts=2025; t=1774477595;\n\tbh=5z/jDTeSkll46GN1LoH/0wYrBiJ7v6EfR3Ufh7zKngw=;\n\th=From:To:Cc:Subject:Date:In-Reply-To:References:From;\n\tb=mScutKATq+2kwNEagS3XnNUkcUImp0+I+22ydozCRJeHQH/1pSzJOSGV+JcBZMN3B\n\t /vM7GS5ZAT5PyJIvg7ln9YK9/2sgYxk7lWqfDsg/wo1/xLD0F4J4pFns6NZJ/NfKmj\n\t EhWt2Ef7WbU7TnNJv3gbXbRBze5Qd/t+iasdx6iLCUeHjoqoMDPguKQKAzQoEfDVJF\n\t sFvRUZey3B2201OxkTKXPp5Kl+bem65UirRn+sQgVFmhH/xRbyJWv/KWEorIqBDehw\n\t dBSQvAo3jsPggeT85o/cr4w3/z5kTkygvGRXzSNL5nqTJHmrIR6GjGdiVKjecZHUYC\n\t wR+MH6d0OT+aA==", "From": "Pablo Neira Ayuso <pablo@netfilter.org>", "To": "netfilter-devel@vger.kernel.org", "Cc": "davem@davemloft.net,\n\tnetdev@vger.kernel.org,\n\tkuba@kernel.org,\n\tpabeni@redhat.com,\n\tedumazet@google.com,\n\tfw@strlen.de,\n\thorms@kernel.org", "Subject": "[PATCH net 09/14] netfilter: nf_conntrack_expect: use expect->helper", "Date": "Wed, 25 Mar 2026 23:26:10 +0100", "Message-ID": "<20260325222615.637793-10-pablo@netfilter.org>", "X-Mailer": "git-send-email 2.47.3", "In-Reply-To": "<20260325222615.637793-1-pablo@netfilter.org>", "References": "<20260325222615.637793-1-pablo@netfilter.org>", "Precedence": "bulk", "X-Mailing-List": "netfilter-devel@vger.kernel.org", "List-Id": "<netfilter-devel.vger.kernel.org>", "List-Subscribe": "<mailto:netfilter-devel+subscribe@vger.kernel.org>", "List-Unsubscribe": "<mailto:netfilter-devel+unsubscribe@vger.kernel.org>", "MIME-Version": "1.0", "Content-Transfer-Encoding": "8bit" }, "content": "Use expect->helper in ctnetlink and /proc to dump the helper name.\nUsing nfct_help() without holding a reference to the master conntrack\nis unsafe.\n\nUse exp->master->helper in ctnetlink path if userspace does not provide\nan explicit helper when creating an expectation to retain the existing\nbehaviour. The ctnetlink expectation path holds the reference on the\nmaster conntrack and nf_conntrack_expect lock and the nfnetlink glue\npath refers to the master ct that is attached to the skb.\n\nReported-by: Hyunwoo Kim <imv4bel@gmail.com>\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\n---\n net/netfilter/nf_conntrack_expect.c | 2 +-\n net/netfilter/nf_conntrack_helper.c | 6 +-----\n net/netfilter/nf_conntrack_netlink.c | 24 ++++++++++--------------\n net/netfilter/nf_conntrack_sip.c | 2 +-\n 4 files changed, 13 insertions(+), 21 deletions(-)", "diff": "diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c\nindex 841e316240da..64977db12b1d 100644\n--- a/net/netfilter/nf_conntrack_expect.c\n+++ b/net/netfilter/nf_conntrack_expect.c\n@@ -666,7 +666,7 @@ static int exp_seq_show(struct seq_file *s, void *v)\n \tif (expect->flags & NF_CT_EXPECT_USERSPACE)\n \t\tseq_printf(s, \"%sUSERSPACE\", delim);\n \n-\thelper = rcu_dereference(nfct_help(expect->master)->helper);\n+\thelper = rcu_dereference(expect->helper);\n \tif (helper) {\n \t\tseq_printf(s, \"%s%s\", expect->flags ? \" \" : \"\", helper->name);\n \t\tif (helper->expect_policy[expect->class].name[0])\ndiff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c\nindex 294a6ffcbccd..1b330ba6613b 100644\n--- a/net/netfilter/nf_conntrack_helper.c\n+++ b/net/netfilter/nf_conntrack_helper.c\n@@ -395,14 +395,10 @@ EXPORT_SYMBOL_GPL(nf_conntrack_helper_register);\n \n static bool expect_iter_me(struct nf_conntrack_expect *exp, void *data)\n {\n-\tstruct nf_conn_help *help = nfct_help(exp->master);\n \tconst struct nf_conntrack_helper *me = data;\n \tconst struct nf_conntrack_helper *this;\n \n-\tif (rcu_access_pointer(exp->helper) == me)\n-\t\treturn true;\n-\n-\tthis = rcu_dereference_protected(help->helper,\n+\tthis = rcu_dereference_protected(exp->helper,\n \t\t\t\t\t lockdep_is_held(&nf_conntrack_expect_lock));\n \treturn this == me;\n }\ndiff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c\nindex a42d14290786..8477c3736432 100644\n--- a/net/netfilter/nf_conntrack_netlink.c\n+++ b/net/netfilter/nf_conntrack_netlink.c\n@@ -3012,7 +3012,7 @@ ctnetlink_exp_dump_expect(struct sk_buff *skb,\n {\n \tstruct nf_conn *master = exp->master;\n \tlong timeout = ((long)exp->timeout.expires - (long)jiffies) / HZ;\n-\tstruct nf_conn_help *help;\n+\tstruct nf_conntrack_helper *helper;\n #if IS_ENABLED(CONFIG_NF_NAT)\n \tstruct nlattr *nest_parms;\n \tstruct nf_conntrack_tuple nat_tuple = {};\n@@ -3057,15 +3057,12 @@ ctnetlink_exp_dump_expect(struct sk_buff *skb,\n \t nla_put_be32(skb, CTA_EXPECT_FLAGS, htonl(exp->flags)) ||\n \t nla_put_be32(skb, CTA_EXPECT_CLASS, htonl(exp->class)))\n \t\tgoto nla_put_failure;\n-\thelp = nfct_help(master);\n-\tif (help) {\n-\t\tstruct nf_conntrack_helper *helper;\n \n-\t\thelper = rcu_dereference(help->helper);\n-\t\tif (helper &&\n-\t\t nla_put_string(skb, CTA_EXPECT_HELP_NAME, helper->name))\n-\t\t\tgoto nla_put_failure;\n-\t}\n+\thelper = rcu_dereference(exp->helper);\n+\tif (helper &&\n+\t nla_put_string(skb, CTA_EXPECT_HELP_NAME, helper->name))\n+\t\tgoto nla_put_failure;\n+\n \texpfn = nf_ct_helper_expectfn_find_by_symbol(exp->expectfn);\n \tif (expfn != NULL &&\n \t nla_put_string(skb, CTA_EXPECT_FN, expfn->name))\n@@ -3394,12 +3391,9 @@ static int ctnetlink_get_expect(struct sk_buff *skb,\n static bool expect_iter_name(struct nf_conntrack_expect *exp, void *data)\n {\n \tstruct nf_conntrack_helper *helper;\n-\tconst struct nf_conn_help *m_help;\n \tconst char *name = data;\n \n-\tm_help = nfct_help(exp->master);\n-\n-\thelper = rcu_dereference(m_help->helper);\n+\thelper = rcu_dereference(exp->helper);\n \tif (!helper)\n \t\treturn false;\n \n@@ -3534,9 +3528,9 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct,\n \t\t struct nf_conntrack_tuple *tuple,\n \t\t struct nf_conntrack_tuple *mask)\n {\n-\tu_int32_t class = 0;\n \tstruct nf_conntrack_expect *exp;\n \tstruct nf_conn_help *help;\n+\tu32 class = 0;\n \tint err;\n \n \thelp = nfct_help(ct);\n@@ -3573,6 +3567,8 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct,\n \n \texp->class = class;\n \texp->master = ct;\n+\tif (!helper)\n+\t\thelper = rcu_dereference(help->helper);\n \trcu_assign_pointer(exp->helper, helper);\n \texp->tuple = *tuple;\n \texp->mask.src.u3 = mask->src.u3;\ndiff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c\nindex 106b2f419e19..20e57cf5c83a 100644\n--- a/net/netfilter/nf_conntrack_sip.c\n+++ b/net/netfilter/nf_conntrack_sip.c\n@@ -924,7 +924,7 @@ static int set_expected_rtp_rtcp(struct sk_buff *skb, unsigned int protoff,\n \t\texp = __nf_ct_expect_find(net, nf_ct_zone(ct), &tuple);\n \n \t\tif (!exp || exp->master == ct ||\n-\t\t nfct_help(exp->master)->helper != nfct_help(ct)->helper ||\n+\t\t exp->helper != nfct_help(ct)->helper ||\n \t\t exp->class != class)\n \t\t\tbreak;\n #if IS_ENABLED(CONFIG_NF_NAT)\n", "prefixes": [ "net", "09/14" ] }