From 2ac41d7009c7c60e0b876760d98bd84a1f91020d Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 8 Sep 2026 12:02:54 +0200 Subject: [PATCH] netfilter: conntrack: Untangle drop and invalid counters In nf_conntrack_in, 'drop' counter increments if nf_conntrack_handle_packet returns NF_DROP. This is a special case with TCP packets (added by commit 6b69fe0c73c0 ("netfilter: nf_conntrack_tcp: fix endless loop") and not related to invalid packets which are responsible for all the other <=0 returns. So don't increment 'invalid' ounter in this case. Signed-off-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso --- net/netfilter/nf_conntrack_core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c index 53401e21ad99..f9b8927327ba 100644 --- a/net/netfilter/nf_conntrack_core.c +++ b/net/netfilter/nf_conntrack_core.c @@ -2065,9 +2065,10 @@ nf_conntrack_in(struct sk_buff *skb, const struct nf_hook_state *state) if (ret == -NF_REPEAT) goto repeat; - NF_CT_STAT_INC_ATOMIC(state->net, invalid); if (ret == NF_DROP) NF_CT_STAT_INC_ATOMIC(state->net, drop); + else + NF_CT_STAT_INC_ATOMIC(state->net, invalid); ret = -ret; goto out;