From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Mon, 16 Mar 2009 14:06:42 +0000 (+0100)
Subject: netfilter: conntrack: don't deliver events for racy packets
X-Git-Url: https://git.karo-electronics.de/?a=commitdiff_plain;h=b1e93a68ca41e7e73766f95ba32ca05cf9052e15;p=linux-beck.git

netfilter: conntrack: don't deliver events for racy packets

This patch skips the delivery of conntrack events if the packet
was drop due to a race condition in the conntrack insertion.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Patrick McHardy <kaber@trash.net>
---

diff --git a/include/net/netfilter/nf_conntrack_core.h b/include/net/netfilter/nf_conntrack_core.h
index c25068e38516..5a449b44ba33 100644
--- a/include/net/netfilter/nf_conntrack_core.h
+++ b/include/net/netfilter/nf_conntrack_core.h
@@ -62,7 +62,8 @@ static inline int nf_conntrack_confirm(struct sk_buff *skb)
 	if (ct && ct != &nf_conntrack_untracked) {
 		if (!nf_ct_is_confirmed(ct) && !nf_ct_is_dying(ct))
 			ret = __nf_conntrack_confirm(skb);
-		nf_ct_deliver_cached_events(ct);
+		if (likely(ret == NF_ACCEPT))
+			nf_ct_deliver_cached_events(ct);
 	}
 	return ret;
 }