diff options
| author | bill bonaparte <programme110@gmail.com> | 2014-11-06 16:36:48 +0300 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2014-11-14 19:43:05 +0300 |
| commit | 5195c14c8b27cc0b18220ddbf0e5ad3328a04187 (patch) | |
| tree | 4cb248fa4103774404e2d8b50cb1c230e694dfaa /net/ipv6 | |
| parent | b326dd37b94e29bf6a15940f4fa66aa21a678ab1 (diff) | |
| download | linux-5195c14c8b27cc0b18220ddbf0e5ad3328a04187.tar.xz | |
netfilter: conntrack: fix race in __nf_conntrack_confirm against get_next_corpse
After removal of the central spinlock nf_conntrack_lock, in
commit 93bb0ceb75be2 ("netfilter: conntrack: remove central
spinlock nf_conntrack_lock"), it is possible to race against
get_next_corpse().
The race is against the get_next_corpse() cleanup on
the "unconfirmed" list (a per-cpu list with seperate locking),
which set the DYING bit.
Fix this race, in __nf_conntrack_confirm(), by removing the CT
from unconfirmed list before checking the DYING bit. In case
race occured, re-add the CT to the dying list.
While at this, fix coding style of the comment that has been
updated.
Fixes: 93bb0ceb75be2 ("netfilter: conntrack: remove central spinlock nf_conntrack_lock")
Reported-by: bill bonaparte <programme110@gmail.com>
Signed-off-by: bill bonaparte <programme110@gmail.com>
Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/ipv6')
0 files changed, 0 insertions, 0 deletions