All of lore.kernel.org
 help / color / mirror / Atom feed
From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Jesper Dangaard Brouer <brouer@redhat.com>
Cc: programme110@gmail.com, netfilter-devel@vger.kernel.org,
	Florian Westphal <fw@strlen.de>,
	netdev@vger.kernel.org, Patrick McHardy <kaber@trash.net>,
	Joerg Marx <joerg.marx@secunet.com>
Subject: Re: [PATCH nf] netfilter: conntrack: fix race in __nf_conntrack_confirm against get_next_corpse
Date: Fri, 14 Nov 2014 17:40:54 +0100	[thread overview]
Message-ID: <20141114164054.GA4222@salvia> (raw)
In-Reply-To: <20141112083500.5404e5f4@redhat.com>

On Wed, Nov 12, 2014 at 08:35:00AM +0100, Jesper Dangaard Brouer wrote:
> > > -	/* We have to check the DYING flag inside the lock to prevent
> > > +
> > > +	/* We have to check the DYING flag after unlink to prevent
> > >  	   a race against nf_ct_get_next_corpse() possibly called from
> > >  	   user context, else we insert an already 'dead' hash, blocking
> > >  	   further use of that particular connection -JM */
> > 
> > While at this, I think it would be good to fix comment style to:
> > 
> >         /* We have ...
> >          * ...
> >          */
> > 
> > I can fix this here, no need to resend, just let me know.
> 
> Okay, I was just trying to keep the changes as minimal as possible, if
> this should go into a stable-kernel.  Your choice.

I'm going to take this patch including the comment style fix, I would
like to avoid specific patches to fix coding style issues, and the
first line of this comment is updated. I think the patch will be still
small to fulfill -stable rules.

I'll send a follow a patch to change the return verdict to NF_DROP to
not mix up different things.

Thanks!

      parent reply	other threads:[~2014-11-14 16:40 UTC|newest]

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2014-11-04  1:48 netfilter: nf_conntrack: there maybe a bug in __nf_conntrack_confirm, when it race against get_next_corpse billbonaparte
2014-11-06 13:00 ` Jesper Dangaard Brouer
2014-11-06 13:36 ` [PATCH nf] netfilter: conntrack: fix race in __nf_conntrack_confirm " Jesper Dangaard Brouer
2014-11-10 16:54   ` Pablo Neira Ayuso
2014-11-12  7:35     ` Jesper Dangaard Brouer
2014-11-12 10:57       ` Jörg Marx
2014-11-13 12:08         ` Pablo Neira Ayuso
2014-11-13 14:33           ` Jörg Marx
2014-11-14 16:40       ` Pablo Neira Ayuso [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20141114164054.GA4222@salvia \
    --to=pablo@netfilter.org \
    --cc=brouer@redhat.com \
    --cc=fw@strlen.de \
    --cc=joerg.marx@secunet.com \
    --cc=kaber@trash.net \
    --cc=netdev@vger.kernel.org \
    --cc=netfilter-devel@vger.kernel.org \
    --cc=programme110@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.