In ctnetlink_change_expect(), the expectation timeout is calculated by multiplying the user-provided timeout value by HZ. Because ntohl() returns a 32-bit unsigned integer, this multiplication is performed in 32-bit arithmetic before being promoted to the 64-bit jiffies format. If a user provides a large enough timeout (e.g., 42949673 on a system with HZ=100), the multiplication wraps around the 32-bit limit, resulting in a near-zero jiffies value. This causes the expectation to be immediately collected by the garbage collector instead of staying open for the requested duration. This patch casts the result of ntohl() to u64 prior to multiplication, matching the safe pattern already used for standard conntrack timeouts. Signed-off-by: Àlex Fernández --- net/netfilter/nf_conntrack_netlink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c index eda5fe4a7..be89bf1ba 100644 --- a/net/netfilter/nf_conntrack_netlink.c +++ b/net/netfilter/nf_conntrack_netlink.c @@ -3466,7 +3466,7 @@ ctnetlink_change_expect(struct nf_conntrack_expect *x, return -ETIME; x->timeout.expires = jiffies + - ntohl(nla_get_be32(cda[CTA_EXPECT_TIMEOUT])) * HZ; + (u64)ntohl(nla_get_be32(cda[CTA_EXPECT_TIMEOUT])) * HZ; add_timer(&x->timeout); } return 0; -- 2.43.0