netfilter: nf_conntrack: death_by_timeout() fix
authorEric Dumazet <eric.dumazet@gmail.com>
Mon, 22 Jun 2009 12:13:55 +0000 (14:13 +0200)
committerPatrick McHardy <kaber@trash.net>
Mon, 22 Jun 2009 12:13:55 +0000 (14:13 +0200)
commit8cc20198cfccd06cef705c14fd50bde603e2e306
tree95934002dceac963afa7b135b39a9b2b6bdce368
parentf6b24caaf933a466397915a08e30e885a32f905a
netfilter: nf_conntrack: death_by_timeout() fix

death_by_timeout() might delete a conntrack from hash list
and insert it in dying list.

 nf_ct_delete_from_lists(ct);
 nf_ct_insert_dying_list(ct);

I believe a (lockless) reader could *catch* ct while doing a lookup
and miss the end of its chain.
(nulls lookup algo must check the null value at the end of lookup and
should restart if the null value is not the expected one.
cf Documentation/RCU/rculist_nulls.txt for details)

We need to change nf_conntrack_init_net() and use a different "null" value,
guaranteed not being used in regular lists. Choose very large values, since
hash table uses [0..size-1] null values.

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Patrick McHardy <kaber@trash.net>
net/netfilter/nf_conntrack_core.c