From mboxrd@z Thu Jan 1 00:00:00 1970 From: Mauricio Faria de Oliveira Subject: [PATCH v2 4.14 5/5] netfilter: nf_conncount: don't skip eviction when age is negative Date: Wed, 2 Jan 2019 18:42:04 -0200 Message-ID: <20190102204204.12389-6-mfo@canonical.com> References: <20190102204204.12389-1-mfo@canonical.com> Cc: Alakesh Haloi , nivedita.singhvi@canonical.com, Pablo Neira Ayuso , Jozsef Kadlecsik , "David S. Miller" , Yi-Hung Wei To: stable@vger.kernel.org, netdev@vger.kernel.org, Florian Westphal Return-path: Received: from youngberry.canonical.com ([91.189.89.112]:43844 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727193AbfABUnI (ORCPT ); Wed, 2 Jan 2019 15:43:08 -0500 Received: from mail-qt1-f199.google.com ([209.85.160.199]) by youngberry.canonical.com with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.76) (envelope-from ) id 1genM2-0002dy-NM for netdev@vger.kernel.org; Wed, 02 Jan 2019 20:43:06 +0000 Received: by mail-qt1-f199.google.com with SMTP id q3so40301888qtq.15 for ; Wed, 02 Jan 2019 12:43:06 -0800 (PST) In-Reply-To: <20190102204204.12389-1-mfo@canonical.com> Sender: netdev-owner@vger.kernel.org List-ID: From: Florian Westphal commit 4cd273bb91b3001f623f516ec726c49754571b1a upstream. (not in Linus's tree now, but in nf.git + linux-next.git already.) age is signed integer, so result can be negative when the timestamps have a large delta. In this case we want to discard the entry. Instead of using age >= 2 || age < 0, just make it unsigned. Fixes: b36e4523d4d56 ("netfilter: nf_conncount: fix garbage collection confirm race") Reviewed-by: Shawn Bohrer Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso [mfo: backport: use older file name, nf_conncount.c -> xt_connlimit.c] Signed-off-by: Mauricio Faria de Oliveira --- net/netfilter/xt_connlimit.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/netfilter/xt_connlimit.c b/net/netfilter/xt_connlimit.c index 913b86ef..b1646c2 100644 --- a/net/netfilter/xt_connlimit.c +++ b/net/netfilter/xt_connlimit.c @@ -141,7 +141,7 @@ find_or_evict(struct net *net, struct xt_connlimit_conn *conn) const struct nf_conntrack_tuple_hash *found; unsigned long a, b; int cpu = raw_smp_processor_id(); - __s32 age; + u32 age; found = nf_conntrack_find_get(net, &conn->zone, &conn->tuple); if (found) -- 2.7.4