From 1320c099d618a278fa17715127d6fecca2786a36 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Sun, 4 Mar 2012 11:34:06 +0100 Subject: [PATCH] netfilter: nf_conntrack: fix early_drop with reliable event delivery With reliable event delivery is enabled, if we fail to deliver the destroy event in early_drop, we put out one entry that is still in the dying list. Reported-by: Kerin Millar Signed-off-by: Pablo Neira Ayuso --- net/netfilter/nf_conntrack_core.c | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-) diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c index ed86a3b..7d2d641 100644 --- a/net/netfilter/nf_conntrack_core.c +++ b/net/netfilter/nf_conntrack_core.c @@ -635,6 +635,11 @@ static noinline int early_drop(struct net *net, unsigned int hash) if (del_timer(&ct->timeout)) { death_by_timeout((unsigned long)ct); + /* Check if we indeed killed this entry. Reliable event + delivery may insert this into the dying list. */ + if (!test_bit(IPS_DYING_BIT, &ct->status)) + return dropped; + dropped = 1; NF_CT_STAT_INC_ATOMIC(net, early_drop); } -- 1.7.7.3