[PATCH 2/6] Fix locking during ctnetlink_new_conntrack()

[Harald Welte]

[NETFILTER] conntrack_netlink: Fix locking during conntrack_create

The current codepath allowed for ip_conntrack_lock to be unlock'ed twice.

Signed-off-by: Pablo Neira <[EMAIL PROTECTED]>
Signed-off-by: Harald Welte <[EMAIL PROTECTED]>

---
commit 0432a984f1e502d036115b1f25da8675ee9cebc4
tree aeb9371bcc39ed9c0d005d7959680a7f92a8f8bd
parent c4e2485887523a16e9c37a21a1d95ac10633ef0a
author Harald Welte <[EMAIL PROTECTED]> Di, 02 Aug 2005 09:38:31 +0200
committer Harald Welte <[EMAIL PROTECTED]> Di, 02 Aug 2005 09:38:31 +0200

 net/ipv4/netfilter/ip_conntrack_netlink.c |   13 +++++++------
 1 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/net/ipv4/netfilter/ip_conntrack_netlink.c 
b/net/ipv4/netfilter/ip_conntrack_netlink.c
--- a/net/ipv4/netfilter/ip_conntrack_netlink.c
+++ b/net/ipv4/netfilter/ip_conntrack_netlink.c
@@ -1052,13 +1052,14 @@ ctnetlink_new_conntrack(struct sock *ctn
                err = -ENOENT;
                if (nlh->nlmsg_flags & NLM_F_CREATE)
                        err = ctnetlink_create_conntrack(cda, &otuple, &rtuple);
+               return err;
+       }
+       /* implicit 'else' */
+
+       /* we only allow nat config for new conntracks */
+       if (cda[CTA_NAT-1]) {
+               err = -EINVAL;
                goto out_unlock;
-       } else {
-               /* we only allow nat config for new conntracks */
-               if (cda[CTA_NAT-1]) {
-                       err = -EINVAL;
-                       goto out_unlock;
-               }
        }
 
        /* We manipulate the conntrack inside the global conntrack table lock,
-- 
- Harald Welte <[EMAIL PROTECTED]>                 http://netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie

pgpsQAFsoTvzR.pgp
Description: PGP signature