]> www.infradead.org Git - users/jedix/linux-maple.git/commit
netfilter: nf_conncount: don't skip eviction when age is negative
authorFlorian Westphal <fw@strlen.de>
Wed, 2 Jan 2019 20:42:04 +0000 (18:42 -0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 9 Jan 2019 16:14:51 +0000 (17:14 +0100)
commit052ccb86b31c184d8ed7d76d1c06d7ca0b8fd32e
treed959cee3c67c53429aef7c64a4b3fccd68d311f2
parent75af3d78168e654a5cd8bbc4c774f97be836165f
netfilter: nf_conncount: don't skip eviction when age is negative

commit 4cd273bb91b3001f623f516ec726c49754571b1a upstream.

(not in Linus's tree now, but in nf.git + linux-next.git already.)

age is signed integer, so result can be negative when the timestamps
have a large delta.  In this case we want to discard the entry.

Instead of using age >= 2 || age < 0, just make it unsigned.

Fixes: b36e4523d4d56 ("netfilter: nf_conncount: fix garbage collection confirm race")
Reviewed-by: Shawn Bohrer <sbohrer@cloudflare.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
[mfo: backport: use older file name, nf_conncount.c -> xt_connlimit.c]
Signed-off-by: Mauricio Faria de Oliveira <mfo@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
net/netfilter/xt_connlimit.c