netfilter: add DEBUG_NET_WARN_ON_ONCE to skb_set_nfct()

Browse source

Trigger a warning if nf_ct_set() overlaps an existing ct object leading
to refcount leak. Add this warning to skb_set_nfct() whose only user is
nf_ct_set() instead.

Update existing nf_ct_set() callers to use nf_reset_ct() first to clean
up stale pointer to conntrack object which migh trigger false positive
warnings.

Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

...

This commit is contained in:

Pablo Neira Ayuso 2026-08-05 23:16:34 +02:00

parent 001b5d347d

commit 5546b082fa

5 changed files with 9 additions and 14 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

1

include/linux/skbuff.h

View file

2

include/net/ip_vs.h

View file

2

net/netfilter/nf_conntrack_core.c

View file

12

net/openvswitch/conntrack.c

View file

6

net/sched/act_ct.c

View file