Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fc350777 authored by Joerg Marx's avatar Joerg Marx Committed by Patrick McHardy
Browse files

netfilter: nf_conntrack: fix a race in __nf_conntrack_confirm against nf_ct_get_next_corpse() 



This race was triggered by a 'conntrack -F' command running in parallel
to the insertion of a hash for a new connection. Losing this race led to
a dead conntrack entry effectively blocking traffic for a particular
connection until timeout or flushing the conntrack hashes again.
Now the check for an already dying connection is done inside the lock.

Signed-off-by: default avatarJoerg Marx <joerg.marx@secunet.com>
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
parent a1d7c1b4

include/net/netfilter/nf_conntrack_core.h

+1 −1
Original line number Diff line number Diff line
@@ -61,7 +61,7 @@ static inline int nf_conntrack_confirm(struct sk_buff *skb) 
	int ret = NF_ACCEPT;



	if (ct && ct != &nf_conntrack_untracked) {

		if (!nf_ct_is_confirmed(ct) && !nf_ct_is_dying(ct))

		if (!nf_ct_is_confirmed(ct))

			ret = __nf_conntrack_confirm(skb);

		if (likely(ret == NF_ACCEPT))

			nf_ct_deliver_cached_events(ct);

net/netfilter/nf_conntrack_core.c

+10 −0
Original line number Diff line number Diff line
@@ -424,6 +424,16 @@ __nf_conntrack_confirm(struct sk_buff *skb) 


	spin_lock_bh(&nf_conntrack_lock);



	/* We have to check the DYING flag inside the lock to prevent

	   a race against nf_ct_get_next_corpse() possibly called from

	   user context, else we insert an already 'dead' hash, blocking

	   further use of that particular connection -JM */



	if (unlikely(nf_ct_is_dying(ct))) {

		spin_unlock_bh(&nf_conntrack_lock);

		return NF_ACCEPT;

	}



	/* See if there's one in the list already, including reverse:

	   NAT could have grabbed it without realizing, since we're

	   not in the hash.  If there is, we lost race. */