Re: [PATCH] update raw patch in POM

[Thomas Graf <tgraf@suug.ch>]

* Patrick McHardy <42B81D75.8090205@trash.net> 2005-06-21 16:00
> Thomas Graf wrote:
> >>If the module gets unloaded, ip_conntrack_untracked refcount isn't 
> >>decreased, it's still 1. So destroy() is never called. In that case it 
> >>should be really easy to trigger on my slow laptop ;->.
> > 
> > How do you explain the BUG() being triggered then?
> 
> Pablo mentioned to me in private mail that he believes the reason
> is packets holding references to ip_conntrack_untracked on module
> removal. I agree, and this patch should fix it. Roberto, could
> you please try it and tell me if it helps?
>
> +	/* wait until all references to ip_conntrack_untracked are dropped */
> +	while (atomic_read(&ip_conntrack_untracked.ct_general.use) > 1)
> +		schedule();

This patch seems fine but it cannot fix the bug. The fact that we
trigger the BUG() implies a serious problem which is that we'd be
calling destroy() on a conntrack entry which was never allocated.
As far as I understood Roberto correctly it happens once he's
unloading the conntrack modules which means that up to that point
we still have > 1 references on that entry. So I think we have
two problems:

 a) We might be calling destroy() on dummy conntrack entries
    such as ip_conntrack_untracked which causes corruption.
 
 b) There might be conntrack entries in caches while removing
    modules.