Hi, all: In function __nf_conntrack_confirm, we check the conntrack if it was alreay dead, before insert it into hash-table. we do this because if we insert an already 'dead' hash, it will block further use of that particular connection. but we don't do that right. let's consider the following case: cpu1 cpu2 __nf_conntrack_confirm get_next_corpse lock corresponding hash-list .... check nf_ct_is_dying(ct) for_each_possible_cpu(cpu) { ...... spin_lock_bh(&pcpu->lock); ...... set_bit(IPS_DYING_BIT, &ct->status); nf_ct_del_from_dying_or_unconfirmed_list(ct); spin_unlock_bh(&pcpu_lock); add_timer(&ct->timeout); } ct->status |= IPS_CONFIRMD; __nf_conntrack_hash_insert(ct); The above case reveal two problems: 1. we may insert a dead conntrack to hash-table, it will block further use of that particular connection. 2. operation on ct->status should be atomic, because it race aginst get_next_corpse. due to this reason, the operation on ct->status in nf_nat_setup_info should be atomic as well. if we want to resolve the first problem, we must delete the unconfirmed conntrack from unconfirmed-list first, then check if it is already dead. Am I right to do this ? Appreciate any comments and reply. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html