Commit 4cd273bb authored Dec 28, 2018 by Florian Westphal Committed by Pablo Neira Ayuso Dec 29, 2018

netfilter: nf_conncount: don't skip eviction when age is negative



age is signed integer, so result can be negative when the timestamps
have a large delta.  In this case we want to discard the entry.

Instead of using age >= 2 || age < 0, just make it unsigned.

Fixes: b36e4523 ("netfilter: nf_conncount: fix garbage collection confirm race")
Reviewed-by: Shawn Bohrer <sbohrer@cloudflare.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

parent c78e7818

net/netfilter/nf_conncount.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -155,7 +155,7 @@ find_or_evict(struct net net, struct nf_conncount_list list,
		const struct nf_conntrack_tuple_hash *found;
		unsigned long a, b;
		int cpu = raw_smp_processor_id();
		__s32 age;
		u32 age;

		found = nf_conntrack_find_get(net, &conn->zone, &conn->tuple);
		if (found)

Admin message