locking issue in ip_conntrack_alter_reply

[Pablo Neira <pablo@eurodev.net>]

Hi everyone,

I submitted a patch for a similar issue not a long time ago. See:

http://lists.netfilter.org/pipermail/netfilter-devel/2004-March/014764.html

Well, actually I found a contradiction here, we write-locked the 
conntrack table but that assertion says that this conntrack is not 
confirmed, this implies that the conntrack is not in the hash table yet. 
If that assertion is right, we should replace that write_lock for a 
read_lock while calling __ip_conntrack_find and remove that write_lock 
at the end of the function.

int ip_conntrack_alter_reply(struct ip_conntrack *conntrack,
                             const struct ip_conntrack_tuple *newreply)
{
        WRITE_LOCK(&ip_conntrack_lock);
        if (__ip_conntrack_find(newreply, conntrack)) {
                WRITE_UNLOCK(&ip_conntrack_lock);
                return 0;
        }
        /* Should be unconfirmed, so not in hash table yet */
        IP_NF_ASSERT(!is_confirmed(conntrack)); <--------------------------


I'll study if that assertion is right before submitting a patch. 
Feedback is always welcome :-).

regards,
Pablo