| Message ID | 1452894918.4622.3.camel@gmail.com |
|---|---|
| State | Awaiting Upstream, archived |
| Delegated to: | David Miller |
| Headers | show |
Sebastian Pöhn <sebastian.poehn@gmail.com> wrote: [ CC netfilter-devel ] > nf_ct_remove_expectations has to be called under nf_conntrack_expect_lock But nf_ct_remove_expectations grabs that lock? Added in: commit ca7433df3a672efc88e08222cfa4b3aa965ca324 Author: Jesper Dangaard Brouer <brouer@redhat.com> netfilter: conntrack: seperate expect locking from nf_conntrack_lock > diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c > index 9511af0..d477375 100644 > --- a/net/netfilter/nf_conntrack_h323_main.c > +++ b/net/netfilter/nf_conntrack_h323_main.c > @@ -1518,7 +1518,9 @@ static int process_urq(struct sk_buff *skb, struct nf_conn *ct, > } > > /* Clear old expect */ > + spin_lock_bh(&nf_conntrack_expect_lock); > nf_ct_remove_expectations(ct); ... so I'd expect deadlock.
You are right. The problem is fixed since 3.15 with the expect_lock refactoring. We found this in 3.12. Probably this is something for stable releases 3.14 and earlier. Am 15.01.2016 11:42 nachm. schrieb "Florian Westphal" <fw@strlen.de>: > > Sebastian Pöhn <sebastian.poehn@gmail.com> wrote: > > [ CC netfilter-devel ] > > > nf_ct_remove_expectations has to be called under nf_conntrack_expect_lock > > But nf_ct_remove_expectations grabs that lock? > > Added in: > > commit ca7433df3a672efc88e08222cfa4b3aa965ca324 > Author: Jesper Dangaard Brouer <brouer@redhat.com> > netfilter: conntrack: seperate expect locking from nf_conntrack_lock > > > diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c > > index 9511af0..d477375 100644 > > --- a/net/netfilter/nf_conntrack_h323_main.c > > +++ b/net/netfilter/nf_conntrack_h323_main.c > > @@ -1518,7 +1518,9 @@ static int process_urq(struct sk_buff *skb, struct nf_conn *ct, > > } > > > > /* Clear old expect */ > > + spin_lock_bh(&nf_conntrack_expect_lock); > > nf_ct_remove_expectations(ct); > > ... so I'd expect deadlock. >
diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c index 9511af0..d477375 100644 --- a/net/netfilter/nf_conntrack_h323_main.c +++ b/net/netfilter/nf_conntrack_h323_main.c @@ -1518,7 +1518,9 @@ static int process_urq(struct sk_buff *skb, struct nf_conn *ct, } /* Clear old expect */ + spin_lock_bh(&nf_conntrack_expect_lock); nf_ct_remove_expectations(ct); + spin_unlock_bh(&nf_conntrack_expect_lock); info->sig_port[dir] = 0; info->sig_port[!dir] = 0;
nf_ct_remove_expectations has to be called under nf_conntrack_expect_lock Signed-off-by: Sebastian Pöhn <sebastian.poehn@gmail.com> ---