Sandro/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-09-18 23:19:34 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

netfilter: conncount: use DEBUG_NET_WARN_ON_ONCE on reaching count limit

Browse Source 
Replace WARN_ON_ONCE with DEBUG_NET_WARN_ON_ONCE in __nf_conncount_add.
The function handles count limit breaches safely by returning
-EOVERFLOW, so a production backtrace is not needed. This prevents
unnecessary system panics when panic_on_warn=1 is enabled in production
systems.

Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Fernando Fernandez Mancera
2026-08-27 14:11:40 +02:00
committed by Pablo Neira Ayuso
parent 1f0391aea8
commit 9b4ab1f3fe
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
net/netfilter/nf_conncount.c
+2 -1
View File
@@ -251,7 +251,8 @@ check_connections:
list->last_gc_count = list->count;
add_new_node:
if (WARN_ON_ONCE(list->count > INT_MAX)) {
if (unlikely(list->count > INT_MAX)) {
DEBUG_NET_WARN_ON_ONCE(1);
err = -EOVERFLOW;
goto out_put;
}