[lkml]   [2008]   [Jul]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Patch in this message
    Subject[patch 28/29] netfilter -stable: nf_conntrack_tcp: fix endless loop

    2.6.25-stable review patch. If anyone has any objections, please let us

    From: Patrick McHardy <>

    netfilter: nf_conntrack_tcp: fix endless loop

    Upstream commit 6b69fe0:

    When a conntrack entry is destroyed in process context and destruction
    is interrupted by packet processing and the packet is an attempt to
    reopen a closed connection, TCP conntrack tries to kill the old entry
    itself and returns NF_REPEAT to pass the packet through the hook
    again. This may lead to an endless loop: TCP conntrack repeatedly
    finds the old entry, but can not kill it itself since destruction
    is already in progress, but destruction in process context can not
    complete since TCP conntrack is keeping the CPU busy.

    Drop the packet in TCP conntrack if we can't kill the connection
    ourselves to avoid this.

    Reported by: [ Kernel bugzilla #11058 ]
    Signed-off-by: Patrick McHardy <>
    Signed-off-by: David S. Miller <>
    Signed-off-by: Greg Kroah-Hartman <>

    net/netfilter/nf_conntrack_proto_tcp.c | 10 ++++++++--
    1 file changed, 8 insertions(+), 2 deletions(-)

    --- a/net/netfilter/nf_conntrack_proto_tcp.c
    +++ b/net/netfilter/nf_conntrack_proto_tcp.c
    @@ -845,9 +845,15 @@ static int tcp_packet(struct nf_conn *ct
    /* Attempt to reopen a closed/aborted connection.
    * Delete this connection and look up again. */
    - if (del_timer(&ct->timeout))
    + /* Only repeat if we can actually remove the timer.
    + * Destruction may already be in progress in process
    + * context and we must give it a chance to terminate.
    + */
    + if (del_timer(&ct->timeout)) {
    ct->timeout.function((unsigned long)ct);
    - return -NF_REPEAT;
    + return -NF_REPEAT;
    + }
    + return -NF_DROP;
    /* Fall through */

     \ /
      Last update: 2008-07-31 01:47    [W:0.021 / U:1.664 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site