Patrick McHardy a écrit :Eric Dumazet wrote:Patrick McHardy a écrit :No, before it is confirmed, its only visible to the CPU handlingEric Dumazet wrote:Sorry, I dont understand how your second patch corrects the problem.Patrick McHardy a écrit :Please have a look at the second patch I just sent. It reliesBefore the conntrack is confirmed, it is exclusively handled by aProblem is timeout.expires is either a relative or absolute timeout,
single CPU. I agree that we need to make sure the IPS_CONFIRMED_BIT
is visible before we add the conntrack to the hash table since the
lookup is lockless, but simply moving the set_bit before the hash
insertion should be fine I think.
and changes happen
in __nf_conntrack_confirm() or __nf_ct_refresh_acct().
We must have a synchronization (an barriers), a single bit wont be
on the RCU barriers to make sure all stores are visible before
other CPUs can find the conntrack.
This (unconfirmed) conntrack is visible by another cpu.
the initial packet of a connection. Confirmation is the step that
makes it visible to other CPUs.
Thanks Patrick, I missed this, and your patch seems fine now :)