From mboxrd@z Thu Jan  1 00:00:00 1970
From: Greg KH <greg@kroah.com>
Subject: Re: [PATCH v3] netfilter: xt_connlimit: fix race in connection
 counting
Date: Thu, 10 Jan 2019 20:19:09 +0100
Message-ID: <20190110191909.GG18221@kroah.com>
References: <20190103002839.GA111435@dev-dsk-alakeshh-2c-f8a3e6e0.us-west-2.amazon.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Cc: stable@vger.kernel.org, Pablo Neira Ayuso <pablo@netfilter.org>,
        Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>,
        Florian Westphal <fw@strlen.de>,
        "David S. Miller" <davem@davemloft.net>,
        Dmitry Andrianov <dmitry.andrianov@alertme.com>,
        Justin Pettit <jpettit@vmware.com>,
        Yi-Hung Wei <yihung.wei@gmail.com>, netdev@vger.kernel.org
To: Alakesh Haloi <alakeshh@amazon.com>
Return-path: <stable-owner@vger.kernel.org>
Content-Disposition: inline
In-Reply-To: <20190103002839.GA111435@dev-dsk-alakeshh-2c-f8a3e6e0.us-west-2.amazon.com>
Sender: stable-owner@vger.kernel.org
List-Id: netdev.vger.kernel.org

On Thu, Jan 03, 2019 at 12:28:46AM +0000, Alakesh Haloi wrote:
> commit b36e4523d4d5 ("netfilter: nf_conncount: fix garbage collection confirm
>         race")
> 
> An iptable rule like the following on a multicore systems will result in
> accepting more connections than set in the rule.
> 
> iptables  -A INPUT -p tcp -m tcp --syn --dport 7777 -m connlimit \
>       --connlimit-above 2000 --connlimit-mask 0 -j DROP
> 
> In check_hlist function, connections that are found in saved connections
> but not in netfilter conntrack are deleted, assuming that those
> connections do not exist anymore. But for multi core systems, there exists
> a small time window, when a connection has been added to the xt_connlimit
> maintained rb-tree but has not yet made to netfilter conntrack table. This
> causes concurrent connections to return incorrect counts and go over limit
> set in iptable rule.
> 
> The fix has been partially backported from the above mentioned upstream
> commit. Introduce timestamp and the owning cpu.
> 
> Signed-off-by: Alakesh Haloi <alakeshh@amazon.com>
> Cc: Pablo Neira Ayuso <pablo@netfilter.org>
> Cc: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
> Cc: Florian Westphal <fw@strlen.de>
> Cc: "David S. Miller" <davem@davemloft.net>
> Cc: stable@vger.kernel.org # v4.15 and before

But 4.14.92 already b36e4523d4d5 ("netfilter: nf_conncount: fix garbage
collection confirm race") and 4cd273bb91b3 ("netfilter: nf_conncount:
don't skip eviction when age is negative") in it.  Are you sure you
still need this patch?

thanks,

greg k-h