tree f71b7726f6501993bc7be9d4d7e6e69d7cd095b2
parent 3f509c689a07a4aa989b426893d8491a7ffcc410
author Pablo Neira Ayuso <pablo@netfilter.org> 1346257549 +0000
committer Pablo Neira Ayuso <pablo@netfilter.org> 1346421028 +0200

netfilter: nf_conntrack: fix racy timer handling with reliable events

Existing code assumes that del_timer returns true for alive conntrack
entries. However, this is not true if reliable events are enabled.
In that case, del_timer may return true for entries that were
just inserted in the dying list. Note that packets / ctnetlink may
hold references to conntrack entries that were just inserted to such
list.

This patch fixes the issue by adding an independent timer for
event delivery. This increases the size of the ecache extension.
Still we can revisit this later and use variable size extensions
to allocate this area on demand.

Tested-by: Oliver Smith <olipro@8.c.9.b.0.7.4.0.1.0.0.2.ip6.arpa>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>