Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b2390969 authored by Changli Gao's avatar Changli Gao Committed by Patrick McHardy
Browse files

netfilter: nf_conntrack: fix the hash random initializing race 



nf_conntrack_alloc() isn't called with nf_conntrack_lock locked, so hash
random initializing code maybe executed more than once on different
CPUs.

Signed-off-by: default avatarChangli Gao <xiaosuo@gmail.com>
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
parent ed0b6d75

net/netfilter/nf_conntrack_core.c

+13 −6
Original line number Diff line number Diff line
@@ -65,8 +65,7 @@ EXPORT_SYMBOL_GPL(nf_conntrack_max); 
DEFINE_PER_CPU(struct nf_conn, nf_conntrack_untracked);

EXPORT_PER_CPU_SYMBOL(nf_conntrack_untracked);



static int nf_conntrack_hash_rnd_initted;

static unsigned int nf_conntrack_hash_rnd;

static unsigned int nf_conntrack_hash_rnd __read_mostly;



static u_int32_t __hash_conntrack(const struct nf_conntrack_tuple *tuple,

				  u16 zone, unsigned int size, unsigned int rnd)
@@ -574,10 +573,18 @@ struct nf_conn *nf_conntrack_alloc(struct net *net, u16 zone, 
{

	struct nf_conn *ct;



	if (unlikely(!nf_conntrack_hash_rnd_initted)) {

		get_random_bytes(&nf_conntrack_hash_rnd,

				sizeof(nf_conntrack_hash_rnd));

		nf_conntrack_hash_rnd_initted = 1;

	if (unlikely(!nf_conntrack_hash_rnd)) {

		unsigned int rand;



		/*

		 * Why not initialize nf_conntrack_rnd in a "init()" function ?

		 * Because there isn't enough entropy when system initializing,

		 * and we initialize it as late as possible.

		 */

		do {

			get_random_bytes(&rand, sizeof(rand));

		} while (!rand);

		cmpxchg(&nf_conntrack_hash_rnd, 0, rand);

	}



	/* We don't want any race condition at early drop stage */