Re: [PATCH] netfilter: nf_conntrack: don't release a conntrack with non-zero refcnt

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Mon, Feb 03, 2014 at 04:39:22PM -0800, Eric Dumazet wrote:
> On Mon, 2014-02-03 at 23:09 +0100, Pablo Neira Ayuso wrote:
> > With this patch, the conntrack refcount is initially set to zero and
> > it is bumped once it is added to any of the list, so we fulfill
> > Eric's golden rule which is that all released objects always have a
> > refcount that equals zero.
> > 
> > Andrey Vagin reports that nf_conntrack_free can't be called for a
> > conntrack with non-zero ref-counter, because it can race with
> > nf_conntrack_find_get().
> > 
> > A conntrack slab is created with SLAB_DESTROY_BY_RCU. Non-zero
> > ref-counter says that this conntrack is used. So when we release
> > a conntrack with non-zero counter, we break this assumption.
> ...
> > Cc: Eric Dumazet <eric.dumazet@gmail.com>
> > Cc: Florian Westphal <fw@strlen.de>
> > Cc: Andrew Vagin <avagin@parallels.com>
> > Reported-by: Andrew Vagin <avagin@parallels.com>
> > Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> > ---
> 
> SGTM !
> 
> Reviewed-by: Eric Dumazet <edumazet@google.com>

Applied, thanks everyone!