[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20230212125320.GA780@breakpoint.cc>
Date: Sun, 12 Feb 2023 13:53:20 +0100
From: Florian Westphal <fw@...len.de>
To: Pablo Neira Ayuso <pablo@...filter.org>
Cc: Florian Westphal <fw@...len.de>, Hangyu Hua <hbh25y@...il.com>,
kadlec@...filter.org, davem@...emloft.net, edumazet@...gle.com,
kuba@...nel.org, pabeni@...hat.com,
netfilter-devel@...r.kernel.org, coreteam@...filter.org,
netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] net: netfilter: fix possible refcount leak in
ctnetlink_create_conntrack()
Pablo Neira Ayuso <pablo@...filter.org> wrote:
> > One way would be to return 0 in that case (in
> > nf_conntrack_hash_check_insert()). What do you think?
>
> This is misleading to the user that adds an entry via ctnetlink?
>
> ETIMEDOUT also looks a bit confusing to report to userspace.
> Rewinding: if the intention is to deal with stale conntrack extension,
> for example, helper module has been removed while this entry was
> added. Then, probably call EAGAIN so nfnetlink has a chance to retry
> transparently?
Seems we first need to add a "bool *inserted" so we know when the ct
entry went public.
I'll also have a look at switching to a refcount based model for
all extensions that reference external objects, this would avoid
the entire problem, but thats likely more intrusive.
Powered by blists - more mailing lists