Commit 8d8890b7 authored by Patrick McHardy's avatar Patrick McHardy

netfilter: nf_conntrack: fix conntrack lookup race

The RCU protected conntrack hash lookup only checks whether the entry
has a refcount of zero to decide whether it is stale. This is not
sufficient, entries are explicitly removed while there is at least
one reference left, possibly more. Explicitly check whether the entry
has been marked as dying to fix this.
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
parent 5c8ec910
......@@ -335,7 +335,8 @@ nf_conntrack_find_get(struct net *net, const struct nf_conntrack_tuple *tuple)
h = __nf_conntrack_find(net, tuple);
if (h) {
ct = nf_ct_tuplehash_to_ctrack(h);
if (unlikely(!atomic_inc_not_zero(&ct->ct_general.use)))
if (unlikely(nf_ct_is_dying(ct) ||
!atomic_inc_not_zero(&ct->ct_general.use)))
h = NULL;
else {
if (unlikely(!nf_ct_tuple_equal(tuple, &h->tuple))) {
......@@ -510,7 +511,8 @@ static noinline int early_drop(struct net *net, unsigned int hash)
cnt++;
}
if (ct && unlikely(!atomic_inc_not_zero(&ct->ct_general.use)))
if (ct && unlikely(nf_ct_is_dying(ct) ||
!atomic_inc_not_zero(&ct->ct_general.use)))
ct = NULL;
if (ct || cnt >= NF_CT_EVICTION_RANGE)
break;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment