Re: [PATCH 1/7] Fix expectation leak

[Patrick McHardy <kaber@trash.net>]

Pablo Neira wrote:
> Patrick McHardy wrote:
> 
>> Pablo Neira wrote:
>>
>>> Yes, but the refcount is incremented twice ;). Please apply.
>>
>>
>> There is one reference for the list and one for the timer. Both are
>> needed since the timer deletion can race with the timer. The one
>> for the list is dropped in __ip_ct_expect_unlink_destroy, the one
>> for the timer after it has been successfully removed.
> 
> 
> OK, in that case the following patch should fix the hung that I'm
> experimenting while trying to remove ip_conntrack. It happens if there's
> an expectation pending to be confirmed. It seems that we forgot to drop
> the refcount when removing a conntrack the list, unlink_expect doesn't
> actually do it. So, in this case the correct call must be
> __ip_conntrack_expect_unlink_destroy instead of unlink_expect.

Seems like you missed a few. Whenever del_timer succeeds we need one
expect_put for the timer and need to call the reference-dropping
variant of unlink_expect. In the expectation timer we need to call
this variant too. This doesn't leave a single case where we use
the other one, so please add the expect_put to unlink_expect.