Re: netfilter: ctnetlink: deliver events for conntracks changed from userspace

[Patrick McHardy <kaber@trash.net>]

Pablo Neira Ayuso wrote:
> Patrick McHardy wrote:
>>>         nf_ct_expect_insert(expect);
>>> +       atomic_inc(&expect->use);
>> This I don't understand - the caller is holding a reference, why
>> do we need another one?
> 
> I thought that the expectation timer may expire while delivering the
> event, but that cannot happen since we still hold the reference until
> the expectation setup is finished (nf_ct_expect_alloc() gets the
> refcount, later nf_ct_expect_put() puts it).

Yep, that was my understanding as well.

>> The next question would be - why do we need those two functions at
>> all? Aside from the apparently unnecessary reference counting, the
>> only difference is reporting, and that actually uses the exact
>> same code path.
> 
> Is the patch attached on the right track?

It looks fine, thanks. I'll test whether it fixes the problem for
me once I can get the damned -rc to boot. I'll let you know how
it goes.