diff mbox series

[SRU,T,3/3] netfilter: nf_conncount: don't skip eviction when age is negative

Message ID 20190114185522.10533-4-mfo@canonical.com
State New
Headers show
Series netfilter: nf_conncount: fix for LP#1811094 | expand

Commit Message

Mauricio Faria de Oliveira Jan. 14, 2019, 6:55 p.m. UTC 
From: Florian Westphal <fw@strlen.de>

BugLink: https://bugs.launchpad.net/bugs/1811094

age is signed integer, so result can be negative when the timestamps
have a large delta.  In this case we want to discard the entry.

Instead of using age >= 2 || age < 0, just make it unsigned.

Fixes: b36e4523d4d56 ("netfilter: nf_conncount: fix garbage collection confirm race")
Reviewed-by: Shawn Bohrer <sbohrer@cloudflare.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
(backported from commit 4cd273bb91b3001f623f516ec726c49754571b1a)
[mfo: backport: use older file name, nf_conncount.c -> xt_connlimit.c
 - s/&conn->zone/NF_CT_DEFAULT_ZONE/ in context line due to lack of
   commit e59ea3df3fc2 ("netfilter: xt_connlimit: honor conntrack zone
   if available")]
Signed-off-by: Mauricio Faria de Oliveira <mfo@canonical.com>
---
 net/netfilter/xt_connlimit.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/net/netfilter/xt_connlimit.c b/net/netfilter/xt_connlimit.c
index df33ca3bc42f..27e95ba202d0 100644
--- a/net/netfilter/xt_connlimit.c
+++ b/net/netfilter/xt_connlimit.c
@@ -100,7 +100,7 @@  find_or_evict(struct net *net, struct xt_connlimit_conn *conn)
 	const struct nf_conntrack_tuple_hash *found;
 	unsigned long a, b;
 	int cpu = raw_smp_processor_id();
-	__s32 age;
+	u32 age;
 
 	found = nf_conntrack_find_get(net, NF_CT_DEFAULT_ZONE, &conn->tuple);
 	if (found)