linux-kernel - Re: [PATCH] [net:netfilter]: Keep conntrack reference until IPsecv6 policy checks are done

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20230302113523.GD23204@breakpoint.cc>
Date:   Thu, 2 Mar 2023 12:35:23 +0100
From:   Florian Westphal <fw@...len.de>
To:     Madhu Koriginja <madhu.koriginja@....com>
Cc:     gerrit@....abdn.ac.uk, davem@...emloft.net, kuznet@....inr.ac.ru,
        yoshfuji@...ux-ipv6.org, edumazet@...gle.com, dccp@...r.kernel.org,
        netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
        vani.namala@....com
Subject: Re: [PATCH] [net:netfilter]: Keep conntrack reference until IPsecv6
 policy checks are done

Madhu Koriginja <madhu.koriginja@....com> wrote:
> Keep the conntrack reference until policy checks have been performed for
> IPsec V6 NAT support. The reference needs to be dropped before a packet is
> queued to avoid having the conntrack module unloadable.

Subject Line should be:

[PATCH net] net: netfilter: Keep conntrack reference until IPsecv6 policy checks are done
or
[PATCH net-next] net: netfilter: Keep ..

see below why net-next makes more sense to me.

> Signed-off-by: Madhu Koriginja <madhu.koriginja@....com>
> 	V1-V2: added missing () in ip6_input.c in below condition
> 	if (!(ipprot->flags & INET6_PROTO_NOPOLICY))

This should appear before your signed-off-by, or 
> ---
>  net/dccp/ipv6.c      |  1 +

... here.

I think its fine to place it here because in this case
the mini-changelog doesn't provide any additional context
worth keeping in git.

Paolo, Jakub, David: This is a bug, but its not a regression
either.  I would suggest that Madhu resubmits this AFTER
net-next re-opens.

Madhu, if thats the agreed-upon procedure, you may include

Reviewed-by: Florian Westphal <fw@...len.de>

when you resend this patch as-is.