Commit 14a50bba authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso Committed by David S. Miller
Browse files

[NETFILTER]: ctnetlink: make sure event order is correct

The following sequence is displayed during events dumping of an ICMP
connection: [NEW] [DESTROY] [UPDATE]

This happens because the event IPCT_DESTROY is delivered in
death_by_timeout(), that is called from the icmp protocol helper
(ct->timeout.function) once we see the reply.

To fix this, we move this event to destroy_conntrack().
Signed-off-by: default avatarPablo Neira Ayuso <>
Signed-off-by: default avatarHarald Welte <>
Signed-off-by: default avatarDavid S. Miller <>
parent 1444fc55
......@@ -316,6 +316,7 @@ destroy_conntrack(struct nf_conntrack *nfct)
IP_NF_ASSERT(atomic_read(&nfct->use) == 0);
ip_conntrack_event(IPCT_DESTROY, ct);
set_bit(IPS_DYING_BIT, &ct->status);
/* To make sure we don't get any weird locking issues here:
......@@ -355,7 +356,6 @@ static void death_by_timeout(unsigned long ul_conntrack)
struct ip_conntrack *ct = (void *)ul_conntrack;
ip_conntrack_event(IPCT_DESTROY, ct);
/* Inside lock so preempt is disabled on module removal path.
* Otherwise we can get spurious warnings. */
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment