Re: BUG: atomic counter underflow at ip_conntrack_event_cache_init+0x91/0xb0 (with patch)

[Patrick McHardy]

Mattia Dongili wrote:
> Hello,
> 
> got this one while trying out 2.6.13-rc4-mm1 (not there in -r2-mm1),
> from a quick look it seems to me that ip_conntrack_{get,put} are not
> simmetric in updating the use count, thus simply adding this line might
> help (it does actually, but I'm not aware if there could be any drawback):
> 
> --- include/linux/netfilter_ipv4/ip_conntrack.h.clean 2005-08-01 
> 15:09:49.000000000 +0200
> +++ include/linux/netfilter_ipv4/ip_conntrack.h       2005-08-01 
> 15:08:52.000000000 +0200
> @@ -298,6 +298,7 @@ static inline struct ip_conntrack *
>  ip_conntrack_get(const struct sk_buff *skb, enum ip_conntrack_info *ctinfo)
>  {
>       *ctinfo = skb->nfctinfo;
> +     nf_conntrack_get(skb->nfct);
>       return (struct ip_conntrack *)skb->nfct;
>  }

This creates lots of refcnt leaks, which is probably why it makes the
underflow go away :) Please try this patch instead.


[NETFILTER]: Fix refcnt underflow in ip_conntrack_event_cache_init

Signed-off-by: Patrick McHardy <[EMAIL PROTECTED]>

---
commit 5d55b8c6bfba6e6e2ffe26c2a2e2561e278428b7
tree d43366a793d2fa3058c15a752010ef0fd22894cc
parent df2e0392536ecdd6385f4319f746045fd6fae38f
author Patrick McHardy <[EMAIL PROTECTED]> Mon, 01 Aug 2005 16:25:53 +0200
committer Patrick McHardy <[EMAIL PROTECTED]> Mon, 01 Aug 2005 16:25:53 +0200

 net/ipv4/netfilter/ip_conntrack_core.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

diff --git a/net/ipv4/netfilter/ip_conntrack_core.c 
b/net/ipv4/netfilter/ip_conntrack_core.c
--- a/net/ipv4/netfilter/ip_conntrack_core.c
+++ b/net/ipv4/netfilter/ip_conntrack_core.c
@@ -146,6 +146,7 @@ void ip_conntrack_event_cache_init(const
 
                /* initialize for this conntrack/packet */
                ecache->ct = ip_conntrack_get(skb, &ctinfo);
+               nf_conntrack_get(&ecache->ct->ct_general);
                /* ecache->events cleared by __deliver_cached_devents() */
        } else {
                DEBUGP("ecache: re-entered for conntrack %p.\n", ct);