diff options
| author | Patrick McHardy | 2010-02-08 20:18:07 +0100 |
|---|---|---|
| committer | David S. Miller | 2010-02-08 20:18:07 +0100 |
| commit | d696c7bdaa55e2208e56c6f98e6bc1599f34286d (patch) | |
| tree | 628782197c21b1e8611a41914865cdba586a1c65 /net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | |
| parent | netfilter: xtables: compat out of scope fix (diff) | |
| download | kernel-qcow2-linux-d696c7bdaa55e2208e56c6f98e6bc1599f34286d.tar.gz kernel-qcow2-linux-d696c7bdaa55e2208e56c6f98e6bc1599f34286d.tar.xz kernel-qcow2-linux-d696c7bdaa55e2208e56c6f98e6bc1599f34286d.zip | |
netfilter: nf_conntrack: fix hash resizing with namespaces
As noticed by Jon Masters <jonathan@jonmasters.org>, the conntrack hash
size is global and not per namespace, but modifiable at runtime through
/sys/module/nf_conntrack/hashsize. Changing the hash size will only
resize the hash in the current namespace however, so other namespaces
will use an invalid hash size. This can cause crashes when enlarging
the hashsize, or false negative lookups when shrinking it.
Move the hash size into the per-namespace data and only use the global
hash size to initialize the per-namespace value when instanciating a
new namespace. Additionally restrict hash resizing to init_net for
now as other namespaces are not handled currently.
Cc: stable@kernel.org
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c')
| -rw-r--r-- | net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c index d171b123a656..d1ea38a7c490 100644 --- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c +++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c @@ -210,7 +210,7 @@ static ctl_table ip_ct_sysctl_table[] = { }, { .procname = "ip_conntrack_buckets", - .data = &nf_conntrack_htable_size, + .data = &init_net.ct.htable_size, .maxlen = sizeof(unsigned int), .mode = 0444, .proc_handler = proc_dointvec, |