Messages in this thread | | | Date | Fri, 19 Jun 2009 13:15:12 +0200 | From | Patrick McHardy <> | Subject | Re: [PATCH] netfilter: conntrack: death_by_timeout() fix |
| |
Eric Dumazet wrote: > [PATCH] netfilter: conntrack: death_by_timeout() fix > > death_by_timeout() might delete a conntrack from hash list > and insert it in dying list. > > nf_ct_delete_from_lists(ct); > nf_ct_insert_dying_list(ct); > > I believe a (lockless) reader could *catch* ct while doing a lookup > and miss the end of its chain. > (nulls lookup algo must check the null value at the end of lookup and > should restart if the null value is not the expected one. > cf Documentation/RCU/rculist_nulls.txt for details) > > We need to change nf_conntrack_init_net() and use a different "null" value, > guaranteed not being used in regular lists. Choose very large values, since > hash table uses [0..size-1] null values.
Applied, thanks Eric.
| |