Commit 4cd273bb authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso

netfilter: nf_conncount: don't skip eviction when age is negative

age is signed integer, so result can be negative when the timestamps
have a large delta.  In this case we want to discard the entry.

Instead of using age >= 2 || age < 0, just make it unsigned.

Fixes: b36e4523 ("netfilter: nf_conncount: fix garbage collection confirm race")
Reviewed-by: default avatarShawn Bohrer <sbohrer@cloudflare.com>
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent c78e7818
...@@ -155,7 +155,7 @@ find_or_evict(struct net *net, struct nf_conncount_list *list, ...@@ -155,7 +155,7 @@ find_or_evict(struct net *net, struct nf_conncount_list *list,
const struct nf_conntrack_tuple_hash *found; const struct nf_conntrack_tuple_hash *found;
unsigned long a, b; unsigned long a, b;
int cpu = raw_smp_processor_id(); int cpu = raw_smp_processor_id();
__s32 age; u32 age;
found = nf_conntrack_find_get(net, &conn->zone, &conn->tuple); found = nf_conntrack_find_get(net, &conn->zone, &conn->tuple);
if (found) if (found)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment