This is a note to let you know that I've just added the patch titled
netfilter: ctnetlink: fix dumping of dying/unconfirmed conntracks
to the 3.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
netfilter-ctnetlink-fix-dumping-of-dying-unconfirmed-conntracks.patch
and it can be found in the queue-3.15 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 266155b2de8fb721ae353688529b2f8bcdde2f90 Mon Sep 17 00:00:00 2001
From: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
Date: Thu, 5 Jun 2014 14:28:44 +0200
Subject: netfilter: ctnetlink: fix dumping of dying/unconfirmed conntracks
From: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
commit 266155b2de8fb721ae353688529b2f8bcdde2f90 upstream.
The dumping prematurely stops, it seems the callback argument that
indicates that all entries have been dumped is set after iterating
on the first cpu list. The dumping also may stop before the entire
per-cpu list content is also dumped.
With this patch, conntrack -L dying now shows the dying list content
again.
Fixes: b7779d06 ("netfilter: conntrack: spinlock per cpu to protect special lists.")
Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
net/netfilter/nf_conntrack_netlink.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1163,9 +1163,6 @@ ctnetlink_dump_list(struct sk_buff *skb,
if (cb->args[2])
return 0;
- if (cb->args[0] == nr_cpu_ids)
- return 0;
-
for (cpu = cb->args[0]; cpu < nr_cpu_ids; cpu++) {
struct ct_pcpu *pcpu;
@@ -1194,6 +1191,7 @@ restart:
rcu_read_unlock();
if (res < 0) {
nf_conntrack_get(&ct->ct_general);
+ cb->args[0] = cpu;
cb->args[1] = (unsigned long)ct;
spin_unlock_bh(&pcpu->lock);
goto out;
@@ -1202,10 +1200,10 @@ restart:
if (cb->args[1]) {
cb->args[1] = 0;
goto restart;
- } else
- cb->args[2] = 1;
+ }
spin_unlock_bh(&pcpu->lock);
}
+ cb->args[2] = 1;
out:
if (last)
nf_ct_put(last);
Patches currently in stable-queue which might be from pablo@xxxxxxxxxxxxx are
queue-3.15/netfilter-nf_nat-fix-oops-on-netns-removal.patch
queue-3.15/netfilter-ctnetlink-fix-refcnt-leak-in-dying-unconfirmed-list-dumper.patch
queue-3.15/netfilter-ctnetlink-fix-dumping-of-dying-unconfirmed-conntracks.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html