diff options
| author | Patrick McHardy <kaber@trash.net> | 2008-04-14 11:15:51 +0200 |
|---|---|---|
| committer | Patrick McHardy <kaber@trash.net> | 2008-04-14 11:15:51 +0200 |
| commit | 55871d04793d9c069ee277b1e98794b88d92ed80 (patch) | |
| tree | 7e06b1ae438b45e9d5b5da8146ba197222d875f4 | |
| parent | 8c87238b726e543f8af4bdb4296020a328df4744 (diff) | |
| download | kernel_samsung_aries-55871d04793d9c069ee277b1e98794b88d92ed80.zip kernel_samsung_aries-55871d04793d9c069ee277b1e98794b88d92ed80.tar.gz kernel_samsung_aries-55871d04793d9c069ee277b1e98794b88d92ed80.tar.bz2 | |
[NETFILTER]: nf_conntrack_extend: warn on confirmed conntracks
New extensions may only be added to unconfirmed conntracks to avoid races
when reallocating the storage.
Also change NF_CT_ASSERT to use WARN_ON to get backtraces.
Signed-off-by: Patrick McHardy <kaber@trash.net>
| -rw-r--r-- | include/net/netfilter/nf_conntrack.h | 9 | ||||
| -rw-r--r-- | net/netfilter/nf_conntrack_extend.c | 3 |
2 files changed, 4 insertions, 8 deletions
diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h index bb9fc85..4a0496a 100644 --- a/include/net/netfilter/nf_conntrack.h +++ b/include/net/netfilter/nf_conntrack.h @@ -65,14 +65,7 @@ union nf_conntrack_help { #include <linux/timer.h> #ifdef CONFIG_NETFILTER_DEBUG -#define NF_CT_ASSERT(x) \ -do { \ - if (!(x)) \ - /* Wooah! I'm tripping my conntrack in a frenzy of \ - netplay... */ \ - printk("NF_CT_ASSERT: %s:%i(%s)\n", \ - __FILE__, __LINE__, __FUNCTION__); \ -} while(0) +#define NF_CT_ASSERT(x) WARN_ON(!(x)) #else #define NF_CT_ASSERT(x) #endif diff --git a/net/netfilter/nf_conntrack_extend.c b/net/netfilter/nf_conntrack_extend.c index 2bd9963..bcc19fa 100644 --- a/net/netfilter/nf_conntrack_extend.c +++ b/net/netfilter/nf_conntrack_extend.c @@ -71,6 +71,9 @@ void *__nf_ct_ext_add(struct nf_conn *ct, enum nf_ct_ext_id id, gfp_t gfp) int i, newlen, newoff; struct nf_ct_ext_type *t; + /* Conntrack must not be confirmed to avoid races on reallocation. */ + NF_CT_ASSERT(!nf_ct_is_confirmed(ct)); + if (!ct->ext) return nf_ct_ext_create(&ct->ext, id, gfp); |