locking issue in alter_reply
Subsystems (2)
PATCH 1/1 locking issue in alter_reply
Hi,
This the first of a set of patches. Actually this patch is a resend, I think that it got lost. Actually, we don't need to write lock the conntrack table because we always call alter_reply with a non-confirmed conntrack.
regards,
Pablo
net/ipv4/netfilter/ip_conntrack_core.c +3 -3
@@ -1075,9 +1075,9 @@int ip_conntrack_alter_reply (struct ip_conntrack *conntrack,const struct ip_conntrack_tuple *newreply) { -WRITE_LOCK (&ip_conntrack_lock); +READ_LOCK (&ip_conntrack_lock);if (__ip_conntrack_find (newreply, conntrack)) { -WRITE_UNLOCK (&ip_conntrack_lock); +READ_UNLOCK (&ip_conntrack_lock);return 0 ; }/* Should be unconfirmed, so not in hash table yet */
@@ -1089,7 +1089,7 @@ conntrack->tuplehash[IP_CT_DIR_REPLY ].tuple = *newreply;if (!conntrack->master &&list_empty (&conntrack->sibling_list)) conntrack->helper =ip_ct_find_helper (newreply); -WRITE_UNLOCK (&ip_conntrack_lock); +READ_UNLOCK (&ip_conntrack_lock);return 1 ; }
Hi Pablo,
Quoted 3 lines · Pablo Neira
Hi,
This the first of a set of patches. Actually this patch is a resend, I think that it got lost. Actually, we don't need to write lock the conntrack table because we always call
alter_replywith a non-confirmed conntrack.
Harald suggested to concentrate our efforts on nf_conntrack and only continue to put bugfixes in ip_conntrack, and I agree with him. This patch is fairly small, but I'll let him decide.
Regards
Patrick
Hi Patrick,
Quoted 3 lines · Patrick McHardy
Harald suggested to concentrate our efforts on
nf_conntrackand only continue to put bugfixes inip_conntrack, and I agree with him. This patch is fairly small, but I'll let him decide.
I see, actually I haven't seen that patch. Well I agree with you, that layer 3 abstraction for the conntrack looks interesting. So I'll concentrate my efforts in nf_conntrack since now.
regards,
Pablo