Re: [PATCH nf v2 1/2] netfilter: nf_conntrack_tcp: defer timeout-lowering invalid log until after unlock

Zihan Xi <[email protected]> wrote:
> nf_tcp_handle_invalid() can lower the timeout of an assured TCP
> conntrack when an out-of-window FIN/RST is answered from the other
> direction.  Today it also logs that event while ct->lock is still held.
> 
> If invalid logging is routed to nfnetlink_log and conntrack export is
> enabled, the log path can re-enter conntrack netlink glue and recurse
> into tcp_to_nlattr() on the same conntrack.  Move this timeout-lowering
> log emission out from under ct->lock by making nf_tcp_handle_invalid()
> return whether logging is needed, then emit the message after unlocking.
> 
> Keep the timeout update unchanged and simplify the log text so this path
> does not need to stash extra state while the lock is held.

Reviewed-by: Florian Westphal <[email protected]>

But consider following up on nf_conntrack_proto_sctp.c.