Re: [PATCH] update raw patch in POM

[Pablo Neira <pablo@eurodev.net>]

Hi Thomas,

Thomas Graf wrote:
> :1175 is the BUG above, right? If so it means that we're about to call
> destroy() on a conntrack entry which is not allocated. I assume it is
> ip_conntrack_untracked.
> 
> My theory is:
> 
> ip_conntrack_untracked is put into the conntrack with a refcnt of 2
> (+1 during init and +1 while assigning it to nfct). Once the packet
> leaves the ip stack we release the first use, when the modules
> get unloaded we release the entry again and call destroy() on it
> resulting in a overall corruption.

If the module gets unloaded, ip_conntrack_untracked refcount isn't 
decreased, it's still 1. So destroy() is never called. In that case it 
should be really easy to trigger on my slow laptop ;->.

> The whole notrack thing seems to be a big hack. ;->

Indeed. A replacement for this is still in the queue of pending things.

--
Pablo