Commit 4cd273bb authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso

netfilter: nf_conncount: don't skip eviction when age is negative

age is signed integer, so result can be negative when the timestamps
have a large delta.  In this case we want to discard the entry.

Instead of using age >= 2 || age < 0, just make it unsigned.

Fixes: b36e4523 ("netfilter: nf_conncount: fix garbage collection confirm race")
Reviewed-by: default avatarShawn Bohrer <>
Signed-off-by: default avatarFlorian Westphal <>
Signed-off-by: default avatarPablo Neira Ayuso <>
parent c78e7818
......@@ -155,7 +155,7 @@ find_or_evict(struct net *net, struct nf_conncount_list *list,
const struct nf_conntrack_tuple_hash *found;
unsigned long a, b;
int cpu = raw_smp_processor_id();
__s32 age;
u32 age;
found = nf_conntrack_find_get(net, &conn->zone, &conn->tuple);
if (found)
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment