Joerg Marx wrote: > On 05/10/2010 05:23 PM, Patrick McHardy wrote: > > ... >> I think this should be fine since the race you describe only affects >> unconfirmed conntracks, but it took me a while to realize that all >> the other spots where the DYING bit is set are fine without holding >> the conntrack lock. >> >> Could you please add a comment to the check in __nf_conntrack_confirm() >> stating that the dying check is supposed to prevent races against >> nf_ct_get_next_corpse()? The semantic of the DYING bit is unfortunately >> a bit overloaded. >> >> Also, since the condition unconfirmed + dying in nf_conntrack_confirm() >> is highly unlikely, I'd suggest to remove the dying check there and only >> perform it in __nf_conntrack_confirm(). >> > > I hope the comment is clearly pointing to the (solved) problem now. I > also removed the obsolete check in nf_conntrack_confirm. Thanks, this looks fine. But I need a formal submission, including a changelog and Signed-off-by: line. Thanks! -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
