path: root/net/netfilter/nf_conntrack_core.c
diff options
authorPatrick McHardy <>2008-11-24 15:56:17 -0800
committerDavid S. Miller <>2008-11-24 15:56:17 -0800
commitb54ad409fd09a395b839fb81f300880d76861c0e (patch)
tree580b23b89c04c85ad9795b37f81174e1bbb5311b /net/netfilter/nf_conntrack_core.c
parent5147d14e995c097571d383fe1287fb33345a51ee (diff)
netfilter: ctnetlink: fix conntrack creation race
Conntrack creation through ctnetlink has two races: - the timer may expire and free the conntrack concurrently, causing an invalid memory access when attempting to put it in the hash tables - an identical conntrack entry may be created in the packet processing path in the time between the lookup and hash insertion Hold the conntrack lock between the lookup and insertion to avoid this. Reported-by: Zoltan Borbely <> Signed-off-by: Patrick McHardy <> Signed-off-by: David S. Miller <>
Diffstat (limited to 'net/netfilter/nf_conntrack_core.c')
1 files changed, 0 insertions, 2 deletions
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 622d7c671cb7..233fdd2d7d21 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -305,9 +305,7 @@ void nf_conntrack_hash_insert(struct nf_conn *ct)
hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
repl_hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
- spin_lock_bh(&nf_conntrack_lock);
__nf_conntrack_hash_insert(ct, hash, repl_hash);
- spin_unlock_bh(&nf_conntrack_lock);