netdev - Re: [PATCH 05/25] netns ct: per-netns conntrack count

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Mon, 23 Jun 2008 12:12:14 +0200
From:	Patrick McHardy <kaber@...sh.net>
To:	Alexey Dobriyan <adobriyan@...il.com>
CC:	netdev@...r.kernel.org, netfilter-devel@...r.kernel.org,
	den@...nvz.org, xemul@...nvz.org, ebiederm@...ssion.com,
	benjamin.thery@...l.net, dlezcano@...ibm.com
Subject: Re: [PATCH 05/25] netns ct: per-netns conntrack count

Alexey Dobriyan wrote:
> proc and sysctl are stubbed to init_net's value, that's for later.
> 
> Note: conntracks are recycled RCU-way, netns as well.
> During destruction, conntrack count of netns is decremented.
> I'm not sure it's not racy and it will not decrement in freed netns
> since conntrack doesn't pin netns (and pinning it is out of question).
> Probably, decrement should be moved earlier.
> 
> FWIW, I haven't seen this race (if it exists at all). But my cloning
> proggie sucks big way, so don't count on me. :^)


Since conntrack cleanup is invoken from netns cleanup while
the namespace still exists, this shouldn't happen. The
conntrack cleanup doesn't return until all entries are
freed, creation of new entries is prevented by unregistering
the hooks previously, at least without namespaces. Mhh ok,
actually this can happen since the hooks don't seem to be
per namespace. In that case, making sure that all devices
from that namespace are unregistered previously should
have the same effect.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html