netfilter: conncount: use DEBUG_NET_WARN_ON_ONCE on reaching count limit

Replace WARN_ON_ONCE with DEBUG_NET_WARN_ON_ONCE in __nf_conncount_add.
The function handles count limit breaches safely by returning
-EOVERFLOW, so a production backtrace is not needed. This prevents
unnecessary system panics when panic_on_warn=1 is enabled in production
systems.

Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/netfilter/nf_conncount.c b/net/netfilter/nf_conncount.c
index 85487f9..4292c3d 100644 (file)
--- a/net/netfilter/nf_conncount.c
+++ b/net/netfilter/nf_conncount.c
@@ -251,7 +251,8 @@ check_connections:
        list->last_gc_count = list->count;
 
 add_new_node:
-       if (WARN_ON_ONCE(list->count > INT_MAX)) {
+       if (unlikely(list->count > INT_MAX)) {
+               DEBUG_NET_WARN_ON_ONCE(1);
                err = -EOVERFLOW;
                goto out_put;
        }