Re: [PATCH 4.14 4/4] netfilter: nf_conncount: fix garbage collection confirm race

On Wed, Jan 2, 2019 at 3:06 PM Florian Westphal fw@strlen.de wrote:

Mauricio Faria de Oliveira mfo@canonical.com wrote:

...

+static const struct nf_conntrack_tuple_hash * +find_or_evict(struct net *net, struct xt_connlimit_conn *conn) +{

• const struct nf_conntrack_tuple_hash *found;
  

• unsigned long a, b;
  

• int cpu = raw_smp_processor_id();
  

• __s32 age;
  

This needs to be 'u32'. Alternatively, also backport

4cd273bb91b3001f623 ("netfilter: nf_conncount: don't skip eviction when age is negative").

Sure, will pick that up. Waiting for more comments before sending a v2.