Fix a deadlock in new_conntrack

Fix a deadlock during conntrack creation. ip_conntrack_lock is unlocked twice.

------------------------------------------------------------------------

Index: netfilter-2.6.14/net/ipv4/netfilter/ip_conntrack_netlink.c
===================================================================

net/ipv4/netfilter/ip_conntrack_netlink.c +5 -6

@@ -1094,13 +1094,12 @@
 		err = -ENOENT;
 		if (nlh->nlmsg_flags & NLM_F_CREATE)
 			err = ctnetlink_create_conntrack(cda, &otuple, &rtuple);
+		return err;
+	}
+	/* we only allow nat config for new conntracks */
+	if (cda[CTA_NAT-1]) {
+		err = -EINVAL;
 		goto out_unlock;
-	} else {
-		/* we only allow nat config for new conntracks */
-		if (cda[CTA_NAT-1]) {
-			err = -EINVAL;
-			goto out_unlock;
-		}
 	}
 
 	/* We manipulate the conntrack inside the global conntrack table lock,

Quoted 2 lines · Pablo Neira

Fix a deadlock during conntrack creation. ip_conntrack_lock is unlocked twice.

Please keep the exit paths at the end by adding a out: label.