Skip to contentSkip to conversation

Fix racy counters zeroing

PATCH Applied Pablo Neira 1 participant 2 messages Nov 8, 2005 – Nov 9, 2005

Subsystems (2)
Networking netfilter
lore
Share & tools
lore

Pablo Neira

author maintainer
#0 lore raw

PATCH 4/8 Fix racy counters zeroing

Fix racy zero counters operation at getting.

Signed-off-by Pablo Neira Ayuso <[email protected]>
Signature · 2 lines
The dawn of the fourth age of Linux firewalling is coming; a time of
great struggle and heroic deeds -- J.Kadlecsik got inspired by J.Morris

Fix racy zero counters operation at getting.

Signed-off-by Pablo Neira Ayuso <[email protected]>
net/ipv4/netfilter/ip_conntrack_netlink.c +6 -4
Index: netfilter-2.6.14.git/net/ipv4/netfilter/ip_conntrack_netlink.c
===================================================================
@@ -770,18 +770,20 @@ ctnetlink_get_conntrack(struct sock *ctn
 	if (err < 0)
 		return err;
 
-	h = ip_conntrack_find_get(&tuple, NULL);
+	write_lock_bh(&ip_conntrack_lock);
+	h = __ip_conntrack_find(&tuple, NULL);
 	if (!h) {
 		DEBUGP("tuple not found in conntrack hash");
+		write_unlock_bh(&ip_conntrack_lock);
 		return -ENOENT;
 	}
 	DEBUGP("tuple found\n");
 	ct = tuplehash_to_ctrack(h);
 
 	err = -ENOMEM;
-	skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
+	skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
 	if (!skb2) {
-		ip_conntrack_put(ct);
+		write_unlock_bh(&ip_conntrack_lock);
 		return -ENOMEM;
 	}
 	NETLINK_CB(skb2).dst_pid = NETLINK_CB(skb).pid;

@@ -794,7 +796,7 @@ ctnetlink_get_conntrack(struct sock *ctn
 		memset(&ct->counters, 0, sizeof(ct->counters));
 #endif
 	
-	ip_conntrack_put(ct);
+	write_unlock_bh(&ip_conntrack_lock);
 	if (err <= 0)
 		goto free;
author maintainer
#1 lore raw
Quoted 1 line · Pablo Neira

Fix racy zero counters operation at getting.

Now I understand. You dropped my patch to zero counters at getting[1] since it is racy, but it seems that it slipped through the patch that changes the allocation flag.

Since this patch applies to your git tree, I just tried to fix what was in your tree.

[1] See [PATCH 6/7] add support for zeroing counters at getting

Signature · 2 lines
The dawn of the fourth age of Linux firewalling is coming; a time of
great struggle and heroic deeds -- J.Kadlecsik got inspired by J.Morris