Re: [PATCH] nf_conntrack_core: Updated nf_conntrack to destroy/refresh conn irrespective of del_timer status

[Patrick McHardy <kaber@trash.net>]

Juneja Kapil wrote:
> Hi Patrick,
> 
>> That sounds pretty reasonable. Is that code available somewhere?
 >
> We are working on licensing aspects and will be glad to share the code
> as and when we get approval.
>

OK thanks.

>>> Can you describe the race scenario mentioned by you?
 >>
>> Very simple:
>>
>> CPU0					CPU1
>> 					timer goes off
>> refresh_timer: mod_timer, rearm		death_by_timeout()
>>
>> timer goes off again
>>
>> Using del_timer prevents us from rearming the timer if it 
>> already went off.
> 
> Thanks for the explanation. I was probably only thinking of the non-SMP
> scenarios. However, I feel that if this cannot be done this simple way,
> then we are in a bit trouble because our need is to make
> nf_ct_refresh_acct work independent of the existing timer being dead or
> alive. 
> While we think about a possible alternatives on respin of patch/control
> module, can you provide some insight into any other alternatives.


The IPS_FIXED_TIMEOUT_BIT should work I guess. It skips
timer updates, but still does accounting (at least in
the current kernel version).