1 files changed, 14 insertions, 1 deletions

diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index 848c6eb55064..d8da6477d6be 100644
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -67,6 +67,7 @@ struct ovs_conntrack_info {
         struct md_mark mark;
         struct md_labels labels;
         char timeout[CTNL_TIMEOUT_NAME_MAX];
+        struct nf_ct_timeout *nf_ct_timeout;
 #if IS_ENABLED(CONFIG_NF_NAT)
         struct nf_nat_range2 range;  /* Only present for SRC NAT and DST NAT. */
 #endif
@@ -697,6 +698,14 @@ static bool skb_nfct_cached(struct net *net,
                 if (help && rcu_access_pointer(help->helper) != info->helper)
                         return false;
         }
+        if (info->nf_ct_timeout) {
+                struct nf_conn_timeout *timeout_ext;
+
+                timeout_ext = nf_ct_timeout_find(ct);
+                if (!timeout_ext || info->nf_ct_timeout !=
+                    rcu_dereference(timeout_ext->timeout))
+                        return false;
+        }
         /* Force conntrack entry direction to the current packet? */
         if (info->force && CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL) {
                 /* Delete the conntrack entry if confirmed, else just release
@@ -1565,7 +1574,7 @@ static int parse_ct(const struct nlattr *attr, struct ovs_conntrack_info *info,
                 case OVS_CT_ATTR_TIMEOUT:
                         memcpy(info->timeout, nla_data(a), nla_len(a));
                         if (!memchr(info->timeout, '\0', nla_len(a))) {
-                                OVS_NLERR(log, "Invalid conntrack helper");
+                                OVS_NLERR(log, "Invalid conntrack timeout");
                                 return -EINVAL;
                         }
                         break;
@@ -1657,6 +1666,10 @@ int ovs_ct_copy_action(struct net *net, const struct nlattr *attr,
                                       ct_info.timeout))
                         pr_info_ratelimited("Failed to associated timeout "
                                             "policy `%s'\n", ct_info.timeout);
+                else
+                        ct_info.nf_ct_timeout = rcu_dereference(
+                                nf_ct_timeout_find(ct_info.ct)->timeout);
+
         }
 
         if (helper) {