diff options
| author |   Pablo Neira Ayuso <pablo@netfilter.org> | 2026-03-12 13:48:47 +0100 |
|---|---|---|
| committer |   Florian Westphal <fw@strlen.de> | 2026-03-13 15:31:15 +0100 |
| commit | 36eae0956f659e48d5366d9b083d9417f3263ddc (patch) | |
| tree | 30bb50fc61c83c599b8f59feb3e9dbc31dc53eae /tools/perf/scripts/python | |
| parent | nf_tables: nft_dynset: fix possible stateful expression memleak in error path (diff) | |
netfilter: nft_ct: drop pending enqueued packets on removal
Packets sitting in nfqueue might hold a reference to:
- templates that specify the conntrack zone, because a percpu area is
used and module removal is possible.
- conntrack timeout policies and helper, where object removal leave
a stale reference.
Since these objects can just go away, drop enqueued packets to avoid
stale reference to them.
If there is a need for finer grain removal, this logic can be revisited
to make selective packet drop upon dependencies.
Fixes: 7e0b2b57f01d ("netfilter: nft_ct: add ct timeout support")
Reported-by: Yiming Qian <yimingqian591@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
Diffstat (limited to 'tools/perf/scripts/python')
0 files changed, 0 insertions, 0 deletions