path: root/net
diff options
authorFlorian Westphal <fw@strlen.de>2018-12-28 01:24:43 +0100
committerPablo Neira Ayuso <pablo@netfilter.org>2018-12-29 02:45:18 +0100
commit4cd273bb91b3001f623f516ec726c49754571b1a (patch)
tree42873aa500164d5b8e21f048390cd5885476723d /net
parentc78e7818f16f687389174c4569243abbec8dc68f (diff)
netfilter: nf_conncount: don't skip eviction when age is negative
age is signed integer, so result can be negative when the timestamps have a large delta. In this case we want to discard the entry. Instead of using age >= 2 || age < 0, just make it unsigned. Fixes: b36e4523d4d56 ("netfilter: nf_conncount: fix garbage collection confirm race") Reviewed-by: Shawn Bohrer <sbohrer@cloudflare.com> Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net')
1 files changed, 1 insertions, 1 deletions
diff --git a/net/netfilter/nf_conncount.c b/net/netfilter/nf_conncount.c
index 3271a4e00500..8bb4ed85c262 100644
--- a/net/netfilter/nf_conncount.c
+++ b/net/netfilter/nf_conncount.c
@@ -155,7 +155,7 @@ find_or_evict(struct net *net, struct nf_conncount_list *list,
const struct nf_conntrack_tuple_hash *found;
unsigned long a, b;
int cpu = raw_smp_processor_id();
- __s32 age;
+ u32 age;
found = nf_conntrack_find_get(net, &conn->zone, &conn->tuple);
if (found)

Privacy Policy