rpms/kernel/devel prevent-runtime-conntrack-changes.patch, NONE, 1.1 kernel.spec, 1.1910, 1.1911
Kyle McMartin
kyle at fedoraproject.org
Wed Feb 3 21:09:16 UTC 2010
- Previous message: rpms/kernel/F-12 prevent-runtime-conntrack-changes.patch, NONE, 1.1 kernel.spec, 1.2001, 1.2002 linux-2.6-utrace.patch, 1.118, 1.119
- Next message: rpms/kernel/F-12 prevent-runtime-conntrack-changes.patch, NONE, 1.1.2.2 kernel.spec, 1.1960.2.4, 1.1960.2.5
- Messages sorted by:
[ date ]
[ thread ]
[ subject ]
[ author ]
Author: kyle
Update of /cvs/pkgs/rpms/kernel/devel
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv21354
Modified Files:
kernel.spec
Added Files:
prevent-runtime-conntrack-changes.patch
Log Message:
* Wed Feb 03 2010 Kyle McMartin <kyle at redhat.com>
- prevent-runtime-conntrack-changes.patch: fix another conntrack issue
identified by jcm.
prevent-runtime-conntrack-changes.patch:
nf_conntrack_core.c | 15 +++++++++++++++
nf_conntrack_expect.c | 2 +-
2 files changed, 16 insertions(+), 1 deletion(-)
--- NEW FILE prevent-runtime-conntrack-changes.patch ---
Jon Masters correctly points out that conntrack hash sizes
(nf_conntrack_htable_size) are global (not per-netns) and
modifiable at runtime via /sys/module/nf_conntrack/hashsize .
Steps to reproduce:
clone(CLONE_NEWNET)
[grow /sys/module/nf_conntrack/hashsize]
exit()
At netns exit we are going to scan random memory for conntracks to be killed.
Apparently there is a code which deals with hashtable resize for
init_net (and it was there befode netns conntrack code), so prohibit
hashsize modification if there is more than one netns exists.
To change hashtable sizes, you need to reload module.
Expectation hashtable size was simply glued to a variable with no code
to rehash expectations, so it was a bug to allow writing to it.
Make "expect_hashsize" readonly.
This is temporarily until we figure out what to do.
Signed-off-by: Alexey Dobriyan <adobriyan at gmail.com>
Cc: stable at kernel.org
---
net/netfilter/nf_conntrack_core.c | 15 +++++++++++++++
net/netfilter/nf_conntrack_expect.c | 2 +-
2 files changed, 16 insertions(+), 1 deletion(-)
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -21,6 +21,7 @@
#include <linux/stddef.h>
#include <linux/slab.h>
#include <linux/random.h>
+#include <linux/rtnetlink.h>
#include <linux/jhash.h>
#include <linux/err.h>
#include <linux/percpu.h>
@@ -1198,6 +1199,20 @@ int nf_conntrack_set_hashsize(const char *val, struct kernel_param *kp)
if (!nf_conntrack_htable_size)
return param_set_uint(val, kp);
+ {
+ struct net *net;
+ unsigned int nr;
+
+ nr = 0;
+ rtnl_lock();
+ for_each_net(net)
+ nr++;
+ rtnl_unlock();
+ /* init_net always exists */
+ if (nr != 1)
+ return -EINVAL;
+ }
+
hashsize = simple_strtoul(val, NULL, 0);
if (!hashsize)
return -EINVAL;
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -569,7 +569,7 @@ static void exp_proc_remove(struct net *net)
#endif /* CONFIG_PROC_FS */
}
-module_param_named(expect_hashsize, nf_ct_expect_hsize, uint, 0600);
+module_param_named(expect_hashsize, nf_ct_expect_hsize, uint, 0400);
int nf_conntrack_expect_init(struct net *net)
{
Index: kernel.spec
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/devel/kernel.spec,v
retrieving revision 1.1910
retrieving revision 1.1911
diff -u -p -r1.1910 -r1.1911
--- kernel.spec 3 Feb 2010 19:03:16 -0000 1.1910
+++ kernel.spec 3 Feb 2010 21:09:14 -0000 1.1911
@@ -716,6 +716,7 @@ Patch12013: linux-2.6-rfkill-all.patch
Patch12015: add-appleir-usb-driver.patch
Patch12016: fix-conntrack-bug-with-namespaces.patch
+Patch12017: prevent-runtime-conntrack-changes.patch
%endif
@@ -1971,6 +1972,10 @@ fi
%changelog
* Wed Feb 03 2010 Kyle McMartin <kyle at redhat.com>
+- prevent-runtime-conntrack-changes.patch: fix another conntrack issue
+ identified by jcm.
+
+* Wed Feb 03 2010 Kyle McMartin <kyle at redhat.com>
- fix-conntrack-bug-with-namespaces.patch: Patch for issue identified
by jcm. (Ref: http://lkml.org/lkml/2010/2/3/112)
- Previous message: rpms/kernel/F-12 prevent-runtime-conntrack-changes.patch, NONE, 1.1 kernel.spec, 1.2001, 1.2002 linux-2.6-utrace.patch, 1.118, 1.119
- Next message: rpms/kernel/F-12 prevent-runtime-conntrack-changes.patch, NONE, 1.1.2.2 kernel.spec, 1.1960.2.4, 1.1960.2.5
- Messages sorted by:
[ date ]
[ thread ]
[ subject ]
[ author ]
More information about the scm-commits
mailing list