From: Qing Luo process_rcf() converts info->timeout with "* HZ" twice, once for the conntrack refresh and once for the Q.931 expectation, both in 32-bit arithmetic. info->timeout is a u32 decoded from the ASN.1 timeToLive field and only checked for being non-zero, so it is remote-controlled by both the endpoint (RegistrationRequest) and the gatekeeper (RegistrationConfirm). With the signed expiry test "(__s32)(ct->timeout - nfct_time_stamp) <= 0", a wrapped product can only cut the lifetime short, never extend it: at HZ=1000 a timeToLive of 2147484 seconds (24.9 days) crosses 2^31, so the entry is born expired and the RAS connection drops mid-call, while 4294968 seconds wraps to 704 jiffies and the Q.931 expectation is reaped almost immediately. A peer that wants a long Q.931 expectation can already get one by sending a non-wrapping timeToLive, so the overflow is not what extends it. Reuse nf_ct_secs_to_jiffies() for both conversions and compute the value once. The helper multiplies in u64 and saturates at INT_MAX, so an oversized timeToLive now saturates to the INT_MAX jiffies ceiling - about 24.8 days at HZ=1000 and 248 days at HZ=100 - which is the same maximum the peer could already request with the largest non-wrapping timeToLive (2147483 seconds at HZ=1000). The longest lifetime a remote peer can force on the RAS conntrack and the Q.931 expectation is therefore unchanged by this patch. Sweeping all 2^32-1 inputs at HZ=1000, the helper never wraps, never yields a value that reads as expired, and matches the old expression up to INT_MAX / HZ; objdump shows the two 32-bit "imul $0x3e8" in ras_help() replaced by a 64-bit multiply plus cmp/cmova saturation. nf_ct_secs_to_jiffies() is added by the SIP helper patch earlier in this series ("netfilter: conntrack: avoid secs-to-jiffies overflow in SIP helper"), which carries a different Fixes: tag. Backporting this patch alone would not build; both patches are tagged for stable and should be picked up together. Fixes: f587de0e2feb ("[NETFILTER]: nf_conntrack/nf_nat: add H.323 helper port") Cc: stable@vger.kernel.org Signed-off-by: Qing Luo --- v2: - Removed the inaccurate "pinned for days" symptom from the commit message, as the 32-bit wrap can only shorten the lifetime, never extend it. - Clarified that oversized TTLs now saturate to INT_MAX jiffies instead. - Noted the build dependency on the SIP patch (1/2) for stable backports. v1: https://lore.kernel.org/all/20261104085925.773471-2-l1138897701@163.com/ --- net/netfilter/nf_conntrack_h323_main.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c index 4cb1665bba02..5e900037fa6f 100644 --- a/net/netfilter/nf_conntrack_h323_main.c +++ b/net/netfilter/nf_conntrack_h323_main.c @@ -1375,9 +1375,11 @@ static int process_rcf(struct sk_buff *skb, struct nf_conn *ct, } if (info->timeout > 0) { + u32 timeout = nf_ct_secs_to_jiffies(info->timeout); + pr_debug("nf_ct_ras: set RAS connection timeout to " "%u seconds\n", info->timeout); - nf_ct_refresh(ct, info->timeout * HZ); + nf_ct_refresh(ct, timeout); /* Set expect timeout */ spin_lock_bh(&nf_conntrack_expect_lock); @@ -1388,8 +1390,7 @@ static int process_rcf(struct sk_buff *skb, struct nf_conn *ct, "timeout to %u seconds for", info->timeout); nf_ct_dump_tuple(&exp->tuple); - WRITE_ONCE(exp->timeout, - nfct_time_stamp + (info->timeout * HZ)); + WRITE_ONCE(exp->timeout, nfct_time_stamp + timeout); } spin_unlock_bh(&nf_conntrack_expect_lock); } -- 2.25.1