netfilter: conncount: use DEBUG_NET_WARN_ON_ONCE on reaching count limit

Browse source

Replace WARN_ON_ONCE with DEBUG_NET_WARN_ON_ONCE in __nf_conncount_add.
The function handles count limit breaches safely by returning
-EOVERFLOW, so a production backtrace is not needed. This prevents
unnecessary system panics when panic_on_warn=1 is enabled in production
systems.

Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

...

This commit is contained in:

Fernando Fernandez Mancera 2026-06-01 21:30:49 +02:00 • committed by Pablo Neira Ayuso

parent 1f0391aea8

commit 9b4ab1f3fe

1 changed files with 2 additions and 1 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

3

net/netfilter/nf_conncount.c

View file