Skip to contentSkip to conversation

locking issue in alter_reply

PATCH In review Pablo Neira 2 participants 3 messages Aug 5, 2004

Subsystems (2)
lore
Share & tools
lore
#0 lore raw

PATCH 1/1 locking issue in alter_reply

Hi,

This the first of a set of patches. Actually this patch is a resend, I think that it got lost. Actually, we don't need to write lock the conntrack table because we always call alter_reply with a non-confirmed conntrack.

regards,
Pablo

net/ipv4/netfilter/ip_conntrack_core.c +3 -3
diff -u -r1.2 ip_conntrack_core.c
@@ -1075,9 +1075,9 @@
 int ip_conntrack_alter_reply(struct ip_conntrack *conntrack,
 			     const struct ip_conntrack_tuple *newreply)
 {
-	WRITE_LOCK(&ip_conntrack_lock);
+	READ_LOCK(&ip_conntrack_lock);
 	if (__ip_conntrack_find(newreply, conntrack)) {
-		WRITE_UNLOCK(&ip_conntrack_lock);
+		READ_UNLOCK(&ip_conntrack_lock);
 		return 0;
 	}
 	/* Should be unconfirmed, so not in hash table yet */
@@ -1089,7 +1089,7 @@
 	conntrack->tuplehash[IP_CT_DIR_REPLY].tuple = *newreply;
 	if (!conntrack->master && list_empty(&conntrack->sibling_list))
 		conntrack->helper = ip_ct_find_helper(newreply);
-	WRITE_UNLOCK(&ip_conntrack_lock);
+	READ_UNLOCK(&ip_conntrack_lock);
 
 	return 1;
 }
#1 lore raw

Hi Pablo,

Quoted 3 lines · Pablo Neira

Hi,

This the first of a set of patches. Actually this patch is a resend, I think that it got lost. Actually, we don't need to write lock the conntrack table because we always call alter_reply with a non-confirmed conntrack.

Harald suggested to concentrate our efforts on nf_conntrack and only continue to put bugfixes in ip_conntrack, and I agree with him. This patch is fairly small, but I'll let him decide.

Regards
Patrick

#2 lore raw

Hi Patrick,

Quoted 3 lines · Patrick McHardy

Harald suggested to concentrate our efforts on nf_conntrack and only continue to put bugfixes in ip_conntrack, and I agree with him. This patch is fairly small, but I'll let him decide.

I see, actually I haven't seen that patch. Well I agree with you, that layer 3 abstraction for the conntrack looks interesting. So I'll concentrate my efforts in nf_conntrack since now.

regards,
Pablo