Dmitry Vyukov <dvyukov@xxxxxxxxxx> wrote: > On Wed, Aug 1, 2018 at 12:35 PM, Florian Westphal <fw@xxxxxxxxx> wrote: > > Dmitry Vyukov <dvyukov@xxxxxxxxxx> wrote: > >> Still can't grasp all details. > >> There is state that we read without taking ct->ct_general.use ref > >> first, namely ct->state and what's used by nf_ct_key_equal. > >> So let's say the entry we want to find is in the list, but > >> ____nf_conntrack_find finds a wrong entry earlier because all state it > >> looks at is random garbage, so it returns the wrong entry to > >> __nf_conntrack_find_get. > > > > If an entry can be found, it can't be random garbage. > > We never link entries into global table until state has been set up. > > But... we don't hold a reference to the entry. So say it's in the > table with valid state, now ____nf_conntrack_find discovers it, now > the entry is removed and reused a dozen of times will all associated > state reinitialization. And nf_ct_key_equal looks at it concurrently > and decides if it's the entry we are looking for or now. I think > unless we hold a ref to the entry, it's state needs to be considered > random garbage for correctness reasoning. It checks if it might be the entry we're looking for. If this was complete random garbage, scheme would not work, as then we could have entry that isn't in table, has nonzero refcount, but has its confirmed bit set. I don't see how that would be possible, any reallocation makes sure ct->status has CONFIRMED bit clear before setting refcount to nonzero value. I think this is the scenario you hint at is: 1. nf_ct_key_equal is true 2. the entry is free'd (or was already free'd) 3. we return NULL to caller due to atomic_inc_not_zero() failure but i fail to see how thats wrong? Sure, we could restart lookup but how would that help? We'd not find the 'candidate' entry again. We might find entry that has been inserted at this very instant but newly allocated entries are only inserted into global table until the skb that created the nf_conn object has made it through the network stack (postrouting for fowarded, or input for local delivery). So, the likelyhood of such restart finding another candidate is close to 0, and won't prevent 'insert race' from happening. -- To unsubscribe from this list: send the line "unsubscribe dccp" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
