1 files changed, 21 insertions, 4 deletions

diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index 26a668a84aa2..cc430f926a85 100644
--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c
@@ -157,11 +157,22 @@ dsthash_find(const struct xt_hashlimit_htable *ht,
 /* allocate dsthash_ent, initialize dst, put in htable and lock it */
 static struct dsthash_ent *
 dsthash_alloc_init(struct xt_hashlimit_htable *ht,
-                   const struct dsthash_dst *dst)
+                   const struct dsthash_dst *dst, bool *race)
 {
         struct dsthash_ent *ent;
 
         spin_lock(&ht->lock);
+
+        /* Two or more packets may race to create the same entry in the
+         * hashtable, double check if this packet lost race.
+         */
+        ent = dsthash_find(ht, dst);
+        if (ent != NULL) {
+                spin_unlock(&ht->lock);
+                *race = true;
+                return ent;
+        }
+
         /* initialize hash with random val at the time we allocate
          * the first hashtable entry */
         if (unlikely(!ht->rnd_initialized)) {
@@ -585,6 +596,7 @@ hashlimit_mt(const struct sk_buff *skb, struct xt_action_param *par)
         unsigned long now = jiffies;
         struct dsthash_ent *dh;
         struct dsthash_dst dst;
+        bool race = false;
         u32 cost;
 
         if (hashlimit_init_dst(hinfo, &dst, skb, par->thoff) < 0)
@@ -593,13 +605,18 @@ hashlimit_mt(const struct sk_buff *skb, struct xt_action_param *par)
         rcu_read_lock_bh();
         dh = dsthash_find(hinfo, &dst);
         if (dh == NULL) {
-                dh = dsthash_alloc_init(hinfo, &dst);
+                dh = dsthash_alloc_init(hinfo, &dst, &race);
                 if (dh == NULL) {
                         rcu_read_unlock_bh();
                         goto hotdrop;
+                } else if (race) {
+                        /* Already got an entry, update expiration timeout */
+                        dh->expires = now + msecs_to_jiffies(hinfo->cfg.expire);
+                        rateinfo_recalc(dh, now, hinfo->cfg.mode);
+                } else {
+                        dh->expires = jiffies + msecs_to_jiffies(hinfo->cfg.expire);
+                        rateinfo_init(dh, hinfo);
                 }
-                dh->expires = jiffies + msecs_to_jiffies(hinfo->cfg.expire);
-                rateinfo_init(dh, hinfo);
         } else {
                 /* update expiration timeout */
                 dh->expires = now + msecs_to_jiffies(hinfo->cfg.expire);