Subject: Re: [PATCH net] netfilter: ctnetlink: fix use-after-free of exp->master in expectation dump

From: Pablo Neira Ayuso <[email-masked]>
Date: Thu, 26 Mar 2026 22:00:39 +0100

On Sun, Mar 08, 2026 at 02:20:29AM +0900, Hyunwoo Kim wrote:
> ctnetlink_exp_dump_table() iterates the expectation hash table under
> rcu_read_lock and dereferences exp->master to access the master
> conntrack's fields (ct_net, tuplehash, ct->ext).  However, expectations
> do not hold a reference on exp->master.  A concurrent conntrack deletion
> via NFNL_SUBSYS_CTNETLINK (a different nfnetlink subsystem mutex) can
> free the master conntrack while the dump is in progress, leading to
> use-after-free on ct->ext which is freed immediately by kfree().
>
> Fix this by taking a reference on exp->master with
> refcount_inc_not_zero() before accessing it.  If the master conntrack is
> already being destroyed, skip the expectation.

For the record, ctnetlink_exp_dump_expect() does not access ct->ext
anymore since f01794106042 ("netfilter: nf_conntrack_expect: use
expect->helper"). I am archiving this proposed patch.

Thanks for reporting.