[NETFILTER]: Wait for untracked references in nf_conntrack module unload

Noticed by Pablo Neira <pablo@eurodev.net>.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 1da678303d78c5436c4e8bd6e1d76b5d95e43f43..a7c7b490cf226b99a376fdd8a98e25729fc8c9de 100644 (file)
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -1383,6 +1383,9 @@ void nf_conntrack_cleanup(void)
                schedule();
                goto i_see_dead_people;
        }
+       /* wait until all references to nf_conntrack_untracked are dropped */
+       while (atomic_read(&nf_conntrack_untracked.ct_general.use) > 1)
+               schedule();
 
        for (i = 0; i < NF_CT_F_NUM; i++) {
                if (nf_ct_cache[i].use == 0)