diff options
author | Liping Zhang | 2017-03-25 01:53:12 +0100 |
---|---|---|
committer | Pablo Neira Ayuso | 2017-03-27 13:47:28 +0200 |
commit | 3b7dabf029478bb80507a6c4500ca94132a2bc0b (patch) | |
tree | 7fdc91ed3c571753fbaffaef9e520882925e1703 /net/netfilter/nfnetlink_cthelper.c | |
parent | netfilter: nfnl_cthelper: Fix memory leak (diff) | |
download | kernel-qcow2-linux-3b7dabf029478bb80507a6c4500ca94132a2bc0b.tar.gz kernel-qcow2-linux-3b7dabf029478bb80507a6c4500ca94132a2bc0b.tar.xz kernel-qcow2-linux-3b7dabf029478bb80507a6c4500ca94132a2bc0b.zip |
netfilter: invoke synchronize_rcu after set the _hook_ to NULL
Otherwise, another CPU may access the invalid pointer. For example:
CPU0 CPU1
- rcu_read_lock();
- pfunc = _hook_;
_hook_ = NULL; -
mod unload -
- pfunc(); // invalid, panic
- rcu_read_unlock();
So we must call synchronize_rcu() to wait the rcu reader to finish.
Also note, in nf_nat_snmp_basic_fini, synchronize_rcu() will be invoked
by later nf_conntrack_helper_unregister, but I'm inclined to add a
explicit synchronize_rcu after set the nf_nat_snmp_hook to NULL. Depend
on such obscure assumptions is not a good idea.
Last, in nfnetlink_cttimeout, we use kfree_rcu to free the time object,
so in cttimeout_exit, invoking rcu_barrier() is not necessary at all,
remove it too.
Signed-off-by: Liping Zhang <zlpnobody@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/netfilter/nfnetlink_cthelper.c')
0 files changed, 0 insertions, 0 deletions