diff options
| author | Eric Dumazet <edumazet@google.com> | 2025-09-24 07:27:09 +0000 |
|---|---|---|
| committer | Florian Westphal <fw@strlen.de> | 2025-09-24 11:50:28 +0200 |
| commit | c5ba345b2d358b07cc4f07253ba1ada73e77d586 (patch) | |
| tree | 7d814a53593ea3b50a952db6013971bc164d40f2 /net/netfilter | |
| parent | 94bd247bc25b7f1560f96e9c912db3ec1fc878ea (diff) | |
netfilter: nf_conntrack: do not skip entries in /proc/net/nf_conntrack
ct_seq_show() has an opportunistic garbage collector :
if (nf_ct_should_gc(ct)) {
nf_ct_kill(ct);
goto release;
}
So if one nf_conn is killed there, next time ct_get_next() runs,
we skip the following item in the bucket, even if it should have
been displayed if gc did not take place.
We can decrement st->skip_elems to tell ct_get_next() one of the items
was removed from the chain.
Fixes: 58e207e4983d ("netfilter: evict stale entries when user reads /proc/net/nf_conntrack")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Diffstat (limited to 'net/netfilter')
| -rw-r--r-- | net/netfilter/nf_conntrack_standalone.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c index 1f14ef0436c6..708b79380f04 100644 --- a/net/netfilter/nf_conntrack_standalone.c +++ b/net/netfilter/nf_conntrack_standalone.c @@ -317,6 +317,9 @@ static int ct_seq_show(struct seq_file *s, void *v) smp_acquire__after_ctrl_dep(); if (nf_ct_should_gc(ct)) { + struct ct_iter_state *st = s->private; + + st->skip_elems--; nf_ct_kill(ct); goto release; } |