From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org, stable@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
"Theodore Ts'o" <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
Chris Wedgwood <reviews@ml.cw.f00f.org>,
Michael Krufky <mkrufky@linuxtv.org>,
Chuck Ebbert <cebbert@redhat.com>,
torvalds@linux-foundation.org, akpm@linux-foundation.org,
alan@lxorguk.ukuu.org.uk, netfilter-devel@lists.netfilter.org,
Patrick McHardy <kaber@trash.net>,
davem@davemloft.net
Subject: [patch 01/20] conntrack: fix {nf, ip}_ct_iterate_cleanup endless loops
Date: Fri, 9 Mar 2007 22:16:21 -0800 [thread overview]
Message-ID: <20070310061621.GB31412@kroah.com> (raw)
In-Reply-To: <20070310061603.GA31412@kroah.com>
[-- Attachment #1: conntrack-fix-nf-ip-_ct_iterate_cleanup-endless-loops.patch --]
[-- Type: text/plain, Size: 3092 bytes --]
-stable review patch. If anyone has any objections, please let us know.
------------------
From: Patrick McHardy <kaber@trash.net>
[NETFILTER]: conntrack: fix {nf,ip}_ct_iterate_cleanup endless loops
Fix {nf,ip}_ct_iterate_cleanup unconfirmed list handling:
- unconfirmed entries can not be killed manually, they are removed on
confirmation or final destruction of the conntrack entry, which means
we might iterate forever without making forward progress.
This can happen in combination with the conntrack event cache, which
holds a reference to the conntrack entry, which is only released when
the packet makes it all the way through the stack or a different
packet is handled.
- taking references to an unconfirmed entry and using it outside the
locked section doesn't work, the list entries are not refcounted and
another CPU might already be waiting to destroy the entry
What the code really wants to do is make sure the references of the hash
table to the selected conntrack entries are released, so they will be
destroyed once all references from skbs and the event cache are dropped.
Since unconfirmed entries haven't even entered the hash yet, simply mark
them as dying and skip confirmation based on that.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
include/linux/netfilter_ipv4/ip_conntrack_core.h | 2 +-
include/net/netfilter/nf_conntrack_core.h | 2 +-
net/ipv4/netfilter/ip_conntrack_core.c | 2 +-
net/netfilter/nf_conntrack_core.c | 2 +-
4 files changed, 4 insertions(+), 4 deletions(-)
--- a/include/linux/netfilter_ipv4/ip_conntrack_core.h
+++ b/include/linux/netfilter_ipv4/ip_conntrack_core.h
@@ -45,7 +45,7 @@ static inline int ip_conntrack_confirm(s
int ret = NF_ACCEPT;
if (ct) {
- if (!is_confirmed(ct))
+ if (!is_confirmed(ct) && !is_dying(ct))
ret = __ip_conntrack_confirm(pskb);
ip_ct_deliver_cached_events(ct);
}
--- a/include/net/netfilter/nf_conntrack_core.h
+++ b/include/net/netfilter/nf_conntrack_core.h
@@ -64,7 +64,7 @@ static inline int nf_conntrack_confirm(s
int ret = NF_ACCEPT;
if (ct) {
- if (!nf_ct_is_confirmed(ct))
+ if (!nf_ct_is_confirmed(ct) && !nf_ct_is_dying(ct))
ret = __nf_conntrack_confirm(pskb);
nf_ct_deliver_cached_events(ct);
}
--- a/net/ipv4/netfilter/ip_conntrack_core.c
+++ b/net/ipv4/netfilter/ip_conntrack_core.c
@@ -1242,7 +1242,7 @@ get_next_corpse(int (*iter)(struct ip_co
list_for_each_entry(h, &unconfirmed, list) {
ct = tuplehash_to_ctrack(h);
if (iter(ct, data))
- goto found;
+ set_bit(IPS_DYING_BIT, &ct->status);
}
write_unlock_bh(&ip_conntrack_lock);
return NULL;
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -1052,7 +1052,7 @@ get_next_corpse(int (*iter)(struct nf_co
list_for_each_entry(h, &unconfirmed, list) {
ct = nf_ct_tuplehash_to_ctrack(h);
if (iter(ct, data))
- goto found;
+ set_bit(IPS_DYING_BIT, &ct->status);
}
write_unlock_bh(&nf_conntrack_lock);
return NULL;
--
next prev parent reply other threads:[~2007-03-10 6:19 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20070310061234.465093436@mini.kroah.org>
2007-03-10 6:16 ` [patch 00/20] 2.6.20-stable review Greg KH
2007-03-10 6:16 ` Greg KH [this message]
2007-03-10 6:16 ` [patch 02/20] nf_conntrack/nf_nat: fix incorrect config ifdefs Greg KH
2007-03-10 6:16 ` [patch 03/20] tcp conntrack: accept SYN|URG as valid Greg KH
2007-03-10 6:17 ` [patch 04/20] nfnetlink_log: fix reference leak Greg KH
2007-03-10 6:17 ` [patch 05/20] nfnetlink_log: fix use after free Greg KH
2007-03-10 6:17 ` [patch 06/20] nfnetlink_log: fix NULL pointer dereference Greg KH
2007-03-10 6:17 ` [patch 07/20] nfnetlink_log: fix possible " Greg KH
2007-03-10 6:17 ` [patch 08/20] ip6_route_me_harder should take into account mark Greg KH
2007-03-10 6:17 ` [patch 09/20] nf_conntrack: fix incorrect classification of IPv6 fragments as ESTABLISHED Greg KH
2007-03-10 6:17 ` [patch 10/20] nfnetlink_log: zero-terminate prefix Greg KH
2007-03-10 6:17 ` [patch 11/20] nfnetlink_log: fix crash on bridged packet Greg KH
2007-03-10 6:18 ` [patch 12/20] nfnetlink_log: fix reference counting Greg KH
2007-03-10 9:14 ` [stable] " Greg KH
2007-03-13 15:45 ` Patrick McHardy
2007-03-10 6:18 ` [patch 13/20] Fix bug 7994 sleeping function called from invalid context Greg KH
2007-03-10 6:18 ` [patch 14/20] bcm43xx: Fix problem with >1 GB RAM Greg KH
2007-03-10 6:18 ` [patch 15/20] Fix compat_getsockopt Greg KH
2007-03-10 6:18 ` [patch 16/20] fix for bugzilla #7544 (keyspan USB-to-serial converter) Greg KH
2007-03-10 6:18 ` [patch 17/20] Fix callback bug in connector Greg KH
2007-03-10 6:18 ` [patch 18/20] Fix sparc64 device register probing Greg KH
2007-03-10 6:18 ` [patch 19/20] Fix timewait jiffies Greg KH
2007-03-10 6:19 ` [patch 20/20] Fix UDP header pointer after pskb_trim_rcsum() Greg KH
2007-03-10 6:23 ` [patch 00/20] 2.6.20-stable review Greg KH
2007-03-10 21:43 ` Chuck Ebbert
2007-03-10 21:49 ` Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20070310061621.GB31412@kroah.com \
--to=gregkh@suse.de \
--cc=akpm@linux-foundation.org \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=cebbert@redhat.com \
--cc=chuckw@quantumlinux.com \
--cc=davej@redhat.com \
--cc=davem@davemloft.net \
--cc=jmforbes@linuxtx.org \
--cc=kaber@trash.net \
--cc=linux-kernel@vger.kernel.org \
--cc=mkrufky@linuxtv.org \
--cc=netfilter-devel@lists.netfilter.org \
--cc=rdunlap@xenotime.net \
--cc=reviews@ml.cw.f00f.org \
--cc=stable@kernel.org \
--cc=torvalds@linux-foundation.org \
--cc=tytso@mit.edu \
--cc=zwane@arm.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).