Re: [PATCH nf-next 1/2] netfilter: conntrack: protect early_drop by rcu read lock

2016-07-12 Thread Pablo Neira Ayuso
On Tue, Jul 12, 2016 at 07:45:00PM +0800, Liping Zhang wrote: > From: Liping Zhang > > User can add ct entry via nfnetlink(IPCTNL_MSG_CT_NEW), and if the total > number reach the nf_conntrack_max, we will try to drop some ct entries. > > But in this case(the main function call path is ctnetlink_

Re: [PATCH nf-next 1/2] netfilter: conntrack: protect early_drop by rcu read lock

2016-07-12 Thread Florian Westphal
Liping Zhang wrote: > From: Liping Zhang > > User can add ct entry via nfnetlink(IPCTNL_MSG_CT_NEW), and if the total > number reach the nf_conntrack_max, we will try to drop some ct entries. > > But in this case(the main function call path is ctnetlink_create_conntrack > -> nf_conntrack_alloc

[PATCH nf-next 1/2] netfilter: conntrack: protect early_drop by rcu read lock

2016-07-12 Thread Liping Zhang
From: Liping Zhang User can add ct entry via nfnetlink(IPCTNL_MSG_CT_NEW), and if the total number reach the nf_conntrack_max, we will try to drop some ct entries. But in this case(the main function call path is ctnetlink_create_conntrack -> nf_conntrack_alloc -> early_drop), rcu_read_lock is no