From: Patrick McHardy <kaber@trash.net>
To: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Afi Gjermund <afigjermund@gmail.com>,
Jan Engelhardt <jengelh@medozas.de>,
netfilter-devel@vger.kernel.org
Subject: Re: nf_conntrack_count versus '/proc/net/nf_conntrack | wc -l' count
Date: Fri, 19 Feb 2010 15:29:43 +0100 [thread overview]
Message-ID: <4B7EA057.10008@trash.net> (raw)
In-Reply-To: <1266588761.3136.12.camel@edumazet-laptop>
Eric Dumazet wrote:
> Le jeudi 18 février 2010 à 16:53 -0800, Afi Gjermund a écrit :
>
> Thanks Afi for providing us more info :)
>
> Patrick, If a user application asks NF_STOLEN, we leak the skb.
> As the entry is freed, there is no way this skb can be found again.
>
> What do you think of following patch ?
> Or should we ignore NF_STOLEN status from user, to let packet still
> queued ?
I think dropping the packet is the expected behaviour.
> [PATCH] nf_queue: fix NF_STOLEN skb leak
>
> commit 3bc38712e3a6e059 (handle NF_STOP and unknown verdicts in
> nf_reinject) was a partial fix to packet leaks.
>
> If user asks NF_STOLEN status, we must free the skb as well.
>
>
Applied, thanks Eric.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
next prev parent reply other threads:[~2010-02-19 14:29 UTC|newest]
Thread overview: 28+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-02-15 17:27 nf_conntrack_count versus '/proc/net/nf_conntrack | wc -l' count Afi Gjermund
2010-02-15 17:29 ` Patrick McHardy
2010-02-15 17:46 ` Jan Engelhardt
2010-02-15 18:04 ` Afi Gjermund
2010-02-15 19:00 ` Jan Engelhardt
2010-02-15 19:30 ` Afi Gjermund
2010-02-15 19:45 ` Afi Gjermund
2010-02-15 20:04 ` Eric Dumazet
2010-02-15 20:33 ` Jan Engelhardt
2010-02-15 21:08 ` Afi Gjermund
2010-02-15 21:52 ` Eric Dumazet
2010-02-15 22:00 ` Afi Gjermund
2010-02-15 22:02 ` Eric Dumazet
2010-02-15 22:10 ` Afi Gjermund
2010-02-18 17:40 ` Afi Gjermund
2010-02-18 17:51 ` Eric Dumazet
2010-02-18 17:55 ` Afi Gjermund
2010-02-18 18:07 ` Eric Dumazet
2010-02-18 18:13 ` Afi Gjermund
2010-02-18 18:19 ` Patrick McHardy
2010-02-18 19:39 ` Afi Gjermund
2010-02-19 0:53 ` Afi Gjermund
2010-02-19 14:12 ` Eric Dumazet
2010-02-19 14:29 ` Patrick McHardy [this message]
2010-02-18 18:12 ` Douglas Diniz
2010-02-18 18:22 ` Patrick McHardy
2010-02-18 18:35 ` Douglas Diniz
2010-02-15 21:17 ` Eric Dumazet
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4B7EA057.10008@trash.net \
--to=kaber@trash.net \
--cc=afigjermund@gmail.com \
--cc=eric.dumazet@gmail.com \
--cc=jengelh@medozas.de \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).