[PATCH net v2 2/2] netfilter: h323: avoid secs-to-jiffies overflow in RAS timeout

[luoqing]

From: Qing Luo <luoqing@xxxxxxxxxx>

process_rcf() converts info->timeout with "* HZ" twice, once for the
conntrack refresh and once for the Q.931 expectation, both in 32-bit
arithmetic.  info->timeout is a u32 decoded from the ASN.1 timeToLive
field and only checked for being non-zero, so it is remote-controlled
by both the endpoint (RegistrationRequest) and the gatekeeper
(RegistrationConfirm).

With the signed expiry test "(__s32)(ct->timeout - nfct_time_stamp)
<= 0", a wrapped product can only cut the lifetime short, never
extend it: at HZ=1000 a timeToLive of 2147484 seconds (24.9 days)
crosses 2^31, so the entry is born expired and the RAS connection
drops mid-call, while 4294968 seconds wraps to 704 jiffies and the
Q.931 expectation is reaped almost immediately.  A peer that wants a
long Q.931 expectation can already get one by sending a non-wrapping
timeToLive, so the overflow is not what extends it.

Reuse nf_ct_secs_to_jiffies() for both conversions and compute the
value once.  The helper multiplies in u64 and saturates at INT_MAX,
so an oversized timeToLive now saturates to the INT_MAX jiffies
ceiling - about 24.8 days at HZ=1000 and 248 days at HZ=100 - which
is the same maximum the peer could already request with the largest
non-wrapping timeToLive (2147483 seconds at HZ=1000).  The longest
lifetime a remote peer can force on the RAS conntrack and the Q.931
expectation is therefore unchanged by this patch.

Sweeping all 2^32-1 inputs at HZ=1000, the helper never wraps, never
yields a value that reads as expired, and matches the old expression
up to INT_MAX / HZ; objdump shows the two 32-bit "imul $0x3e8" in
ras_help() replaced by a 64-bit multiply plus cmp/cmova saturation.

nf_ct_secs_to_jiffies() is added by the SIP helper patch earlier in
this series ("netfilter: conntrack: avoid secs-to-jiffies overflow in
SIP helper"), which carries a different Fixes: tag.  Backporting this
patch alone would not build; both patches are tagged for stable and
should be picked up together.

Fixes: f587de0e2feb ("[NETFILTER]: nf_conntrack/nf_nat: add H.323 helper port")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Qing Luo <luoqing@xxxxxxxxxx>
---

v2:
- Removed the inaccurate "pinned for days" symptom from the commit message,
  as the 32-bit wrap can only shorten the lifetime, never extend it.
- Clarified that oversized TTLs now saturate to INT_MAX jiffies instead.
- Noted the build dependency on the SIP patch (1/2) for stable backports.

v1: https://lore.kernel.org/all/20261104085925.773471-2-l1138897701@xxxxxxx/

---
 net/netfilter/nf_conntrack_h323_main.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c
index 4cb1665bba02..5e900037fa6f 100644
--- a/net/netfilter/nf_conntrack_h323_main.c
+++ b/net/netfilter/nf_conntrack_h323_main.c
@@ -1375,9 +1375,11 @@ static int process_rcf(struct sk_buff *skb, struct nf_conn *ct,
 	}
 
 	if (info->timeout > 0) {
+		u32 timeout = nf_ct_secs_to_jiffies(info->timeout);
+
 		pr_debug("nf_ct_ras: set RAS connection timeout to "
 			 "%u seconds\n", info->timeout);
-		nf_ct_refresh(ct, info->timeout * HZ);
+		nf_ct_refresh(ct, timeout);
 
 		/* Set expect timeout */
 		spin_lock_bh(&nf_conntrack_expect_lock);
@@ -1388,8 +1390,7 @@ static int process_rcf(struct sk_buff *skb, struct nf_conn *ct,
 				 "timeout to %u seconds for",
 				 info->timeout);
 			nf_ct_dump_tuple(&exp->tuple);
-			WRITE_ONCE(exp->timeout,
-				   nfct_time_stamp + (info->timeout * HZ));
+			WRITE_ONCE(exp->timeout, nfct_time_stamp + timeout);
 		}
 		spin_unlock_bh(&nf_conntrack_expect_lock);
 	}
-- 
2.25.1