diff options
| author | Michal Miroslaw <mirq-linux@rere.qmqm.pl> | 2007-03-04 16:00:04 -0800 |
|---|---|---|
| committer | David S. Miller <davem@sunset.davemloft.net> | 2007-03-05 13:25:26 -0800 |
| commit | b4d6202b3652f5dbce358b99dee7d7c80b567529 (patch) | |
| tree | 9aa929b69edf17b83e0225fd221cd27672c64705 | |
| parent | 7d90e86d31e8beeb66d6754aece890ac4a579887 (diff) | |
| download | op-kernel-dev-b4d6202b3652f5dbce358b99dee7d7c80b567529.zip op-kernel-dev-b4d6202b3652f5dbce358b99dee7d7c80b567529.tar.gz | |
[NETFILTER]: nfnetlink_log: fix reference counting
Fix reference counting (memory leak) problem in __nfulnl_send() and callers
related to packet queueing.
Signed-off-by: Michal Miroslaw <mirq-linux@rere.qmqm.pl>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | net/netfilter/nfnetlink_log.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c index d0af8bc..91a0972 100644 --- a/net/netfilter/nfnetlink_log.c +++ b/net/netfilter/nfnetlink_log.c @@ -218,6 +218,9 @@ _instance_destroy2(struct nfulnl_instance *inst, int lock) spin_lock_bh(&inst->lock); if (inst->skb) { + /* timer "holds" one reference (we have one more) */ + if (del_timer(&inst->timer)) + instance_put(inst); if (inst->qlen) __nfulnl_send(inst); if (inst->skb) { @@ -362,9 +365,6 @@ __nfulnl_send(struct nfulnl_instance *inst) { int status; - if (timer_pending(&inst->timer)) - del_timer(&inst->timer); - if (!inst->skb) return 0; @@ -689,6 +689,9 @@ nfulnl_log_packet(unsigned int pf, * enough room in the skb left. flush to userspace. */ UDEBUG("flushing old skb\n"); + /* timer "holds" one reference (we have another one) */ + if (del_timer(&inst->timer)) + instance_put(inst); __nfulnl_send(inst); if (!(inst->skb = nfulnl_alloc_skb(nlbufsiz, size))) { |
