[PATCH nf-next,v3 1/2] netfilter: nf_conntrack_helper: remove synchronize_rcu() on helper removal
Pablo Neira Ayuso <[email protected]>
| Newsgroups | gmane.comp.security.firewalls.netfilter.devel |
|---|---|
| Message-ID | <[email protected]> |
The helper stays around after unregistration if it is still in use, turn the expectation removal into a best effort clean up. A helper might win race to create an expectation while it is going away, but such expectation still depends on master conntrack. Signed-off-by: Pablo Neira Ayuso <[email protected]> --- v3: - new in this series net/netfilter/nf_conntrack_helper.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c index 506c58034761..5cafb133ba0c 100644 --- a/net/netfilter/nf_conntrack_helper.c +++ b/net/netfilter/nf_conntrack_helper.c @@ -458,11 +458,9 @@ void nf_conntrack_helper_unregister(struct nf_conntrack_helper *me) /* This helper is going away, disable it. */ rcu_assign_pointer(me->help, NULL); - /* Make sure every nothing is still using the helper unless its a - * connection in the hash. + /* This is best effort, helper might win race to create an + * expectation but it still depends on the master conntrack. */ - synchronize_rcu(); - nf_ct_expect_iterate_destroy(expect_iter_me, me); if (refcount_dec_and_test(&me->ct_refcnt)) -- 2.47.3