From 3bbba78afad15b303372a701c571840395dea7a1 Mon Sep 17 00:00:00 2001
From: Florian Westphal <fwestpha@redhat.com>
Date: Wed, 13 May 2026 17:24:38 +0200
Subject: [PATCH] netfilter: nft_ct: fix missing expect put in obj eval

JIRA: https://redhat.atlassian.net/browse/RHEL-168848
Upstream Status: commit 19f94b6fee75

commit 19f94b6fee75b3ef7fbc06f3745b9a771a8a19a4
Author: Li Xiasong <lixiasong1@huawei.com>
Date:   Thu May 7 22:04:23 2026 +0800

    netfilter: nft_ct: fix missing expect put in obj eval

    nft_ct_expect_obj_eval() allocates an expectation and may call
    nf_ct_expect_related(), but never drops its local reference.

    Add nf_ct_expect_put(exp) before return to balance allocation.

    Fixes: 857b46027d6f ("netfilter: nft_ct: add ct expectations support")
    Cc: stable@vger.kernel.org
    Signed-off-by: Li Xiasong <lixiasong1@huawei.com>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

Signed-off-by: Florian Westphal <fwestpha@redhat.com>

diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c
index d0090d0..d877767 100644
--- a/net/netfilter/nft_ct.c
+++ b/net/netfilter/nft_ct.c
@@ -1378,6 +1378,8 @@ static void nft_ct_expect_obj_eval(struct nft_object *obj,
 
 	if (nf_ct_expect_related(exp, 0) != 0)
 		regs->verdict.code = NF_DROP;
+
+	nf_ct_expect_put(exp);
 }
 
 static const struct nla_policy nft_ct_expect_policy[NFTA_CT_EXPECT_MAX + 1] = {