Re: [PATCH] Prevent crash on ip_conntrack removal

[Nivedita Singhvi <niv@us.ibm.com>]

David Stevens wrote:

> So, one solution would be to set skb->dst for the head (if NULL)  based
> on a non-null fragment skb->dst. I believe that would prevent the problem
> case without dropping the fragment, since it'll be processed post-routing
> only if one of the frags is.

This would be more performant than dropping the frags, and
requiring a retransmit (or lack thereof, depending on protocol).

> When I was looking at it, I wondered if conntrack really has a need to
> reassemble itself, though. Couldn't it let IP do the reassembling and

I asked Harald this when I met him last, and he said it
does need to. So I don't think this (having conntrack
reassemble) is avoidable, unfortunately.

Of course, fragmentation, on the other hand, :), ...

thanks,
Nivedita