From: Lily Huang Date: Fri, 25 Aug 2017 20:39:00 +0000 (-0700) Subject: conntrack: Fix ct-clean thread crash bug. X-Git-Tag: v2.12.3~2716^2~2 X-Git-Url: https://git.proxmox.com/?a=commitdiff_plain;h=d8c5a93bd1f763938ac7fe0fef61151d29f97e1b;hp=cd995c739a330dbcaee6433c08ecaad62791a56b;p=mirror_ovs.git conntrack: Fix ct-clean thread crash bug. Conn should be removed from the connection expiry list when the connection tracker experiences NAT resource exhaustion and the connection needing NAT mapping cannot get it. If this is not done, the connection tracker can crash during cleanup of expired connections by the clean thread. This crash will be triggered when a established flow do ct(nat) again, like "ip,actions=ct(table=1) table=1,in_port=1,ip,actions=ct(commit,nat(dst=5.5.5.5)),2 table=1,in_port=2,ip,ct_state=+est,actions=1 table=1,in_port=1,ip,ct_state=+est,actions=2" Fixes: bd5e81a0e596 ("Userspace Datapath: Add ALG infra and FTP.") Signed-off-by: Lili Huang Signed-off-by: Darrell Ball --- diff --git a/AUTHORS.rst b/AUTHORS.rst index 9cf363801..1fc42b5ff 100644 --- a/AUTHORS.rst +++ b/AUTHORS.rst @@ -193,6 +193,7 @@ Lei Huang huang.f.lei@gmail.com Leif Madsen lmadsen@redhat.com Leo Alterman lalterman@nicira.com Lilijun jerry.lilijun@huawei.com +Lili Huang huanglili.huang@huawei.com Linda Sun lsun@vmware.com Lior Neudorfer lior@guardicore.com Lorand Jakab lojakab@cisco.com diff --git a/lib/conntrack.c b/lib/conntrack.c index c61bcd697..419cb1def 100644 --- a/lib/conntrack.c +++ b/lib/conntrack.c @@ -805,6 +805,7 @@ conn_not_found(struct conntrack *ct, struct dp_packet *pkt, * against with firewall rules or a separate firewall. * Also using zone partitioning can limit DoS impact. */ nat_res_exhaustion: + ovs_list_remove(&nc->exp_node); delete_conn(nc); /* conn_for_un_nat_copy is a local variable in process_one; this * memset() serves to document that conn_for_un_nat_copy is from