netfilter: conntrack: restart iteration on resize

We could some conntracks when a resize occurs in parallel.

Avoid this by sampling generation seqcnt and doing a restart if needed.
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

net/netfilter/nf_conntrack_core.c

@@ -1623,11 +1623,14 @@ get_next_corpse(int (*iter)(struct nf_conn *i, void *data),
 static void nf_ct_iterate_cleanup(int (*iter)(struct nf_conn *i, void *data),
 				  void *data, u32 portid, int report)
 {
+	unsigned int bucket = 0, sequence;
 	struct nf_conn *ct;
-	unsigned int bucket = 0;
 
 	might_sleep();
 
+	for (;;) {
+		sequence = read_seqcount_begin(&nf_conntrack_generation);
+
 		while ((ct = get_next_corpse(iter, data, &bucket)) != NULL) {
 			/* Time to push up daises... */
 
@@ -1635,6 +1638,11 @@ static void nf_ct_iterate_cleanup(int (*iter)(struct nf_conn *i, void *data),
 			nf_ct_put(ct);
 			cond_resched();
 		}
+
+		if (!read_seqcount_retry(&nf_conntrack_generation, sequence))
+			break;
+		bucket = 0;
+	}
 }
 
 struct iter_data {