You are right. The problem is fixed since 3.15 with the expect_lock refactoring. We found this in 3.12. Probably this is something for stable releases 3.14 and earlier. Am 15.01.2016 11:42 nachm. schrieb "Florian Westphal" <fw@xxxxxxxxx>: > > Sebastian Pöhn <sebastian.poehn@xxxxxxxxx> wrote: > > [ CC netfilter-devel ] > > > nf_ct_remove_expectations has to be called under nf_conntrack_expect_lock > > But nf_ct_remove_expectations grabs that lock? > > Added in: > > commit ca7433df3a672efc88e08222cfa4b3aa965ca324 > Author: Jesper Dangaard Brouer <brouer@xxxxxxxxxx> > netfilter: conntrack: seperate expect locking from nf_conntrack_lock > > > diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c > > index 9511af0..d477375 100644 > > --- a/net/netfilter/nf_conntrack_h323_main.c > > +++ b/net/netfilter/nf_conntrack_h323_main.c > > @@ -1518,7 +1518,9 @@ static int process_urq(struct sk_buff *skb, struct nf_conn *ct, > > } > > > > /* Clear old expect */ > > + spin_lock_bh(&nf_conntrack_expect_lock); > > nf_ct_remove_expectations(ct); > > ... so I'd expect deadlock. > -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
