From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Miller Subject: Re: [PATCH net] Revert "netfilter: conntrack: fix race in __nf_conntrack_confirm against get_next_corpse" Date: Tue, 25 Nov 2014 15:00:52 -0500 (EST) Message-ID: <20141125.150052.718297541684545720.davem@davemloft.net> References: <1416941687-25471-1-git-send-email-pablo@netfilter.org> Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit Cc: netfilter-devel@vger.kernel.org, netdev@vger.kernel.org, brouer@redhat.com To: pablo@netfilter.org Return-path: Received: from shards.monkeyblade.net ([149.20.54.216]:37856 "EHLO shards.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750882AbaKYUAy (ORCPT ); Tue, 25 Nov 2014 15:00:54 -0500 In-Reply-To: <1416941687-25471-1-git-send-email-pablo@netfilter.org> Sender: netfilter-devel-owner@vger.kernel.org List-ID: From: Pablo Neira Ayuso Date: Tue, 25 Nov 2014 19:54:47 +0100 > This reverts commit 5195c14c8b27cc0b18220ddbf0e5ad3328a04187. > > If the conntrack clashes with an existing one, it is left out of > the unconfirmed list, thus, crashing when dropping the packet and > releasing the conntrack since golden rule is that conntracks are > always placed in any of the existing lists for traceability reasons. > > Reported-by: Daniel Borkmann > Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=88841 > Signed-off-by: Pablo Neira Ayuso > --- > Hi David, > > Could you manually apply this to your net tree? We have a better > candidate fix to replace this broken patch that I will pass to you > once it gets sufficient testing. Done, thanks Pablo.