Merge branch 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux...

[firefly-linux-kernel-4.4.55.git] / net / netfilter / nf_conntrack_core.c

diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index b83c530c5e0a391c7f09e5ee8950884991377053..eeeb8bc73982275655e37342c214f1fa2669efb2 100644 (file)
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -424,6 +424,16 @@ __nf_conntrack_confirm(struct sk_buff *skb)
 
        spin_lock_bh(&nf_conntrack_lock);
 
+       /* We have to check the DYING flag inside the lock to prevent
+          a race against nf_ct_get_next_corpse() possibly called from
+          user context, else we insert an already 'dead' hash, blocking
+          further use of that particular connection -JM */
+
+       if (unlikely(nf_ct_is_dying(ct))) {
+               spin_unlock_bh(&nf_conntrack_lock);
+               return NF_ACCEPT;
+       }
+
        /* See if there's one in the list already, including reverse:
           NAT could have grabbed it without realizing, since we're
           not in the hash.  If there is, we lost race. */