diff options
| author | Patrick McHardy <kaber@trash.net> | 2007-02-12 11:09:19 -0800 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2007-02-12 11:09:19 -0800 |
| commit | c3a47ab3e5ad62601449e4e5401352271b777e28 (patch) | |
| tree | 3b3f6810796367efa5f76209aed12bec6c6a8b17 | |
| parent | ebaf0c6032f525ddb0158fb59848d41899dce8cd (diff) | |
| download | op-kernel-dev-c3a47ab3e5ad62601449e4e5401352271b777e28.zip op-kernel-dev-c3a47ab3e5ad62601449e4e5401352271b777e28.tar.gz | |
[NETFILTER]: Properly use RCU in nf_ct_attach
Use rcu_assign_pointer/rcu_dereference for ip_ct_attach pointer instead
of self-made RCU and use rcu_read_lock to make sure the conntrack module
doesn't disappear below us while calling it, since this function can be
called from outside the netfilter hooks.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | net/ipv4/netfilter/ip_conntrack_core.c | 4 | ||||
| -rw-r--r-- | net/netfilter/core.c | 9 | ||||
| -rw-r--r-- | net/netfilter/nf_conntrack_core.c | 4 |
3 files changed, 10 insertions, 7 deletions
diff --git a/net/ipv4/netfilter/ip_conntrack_core.c b/net/ipv4/netfilter/ip_conntrack_core.c index 04e466d..508e600 100644 --- a/net/ipv4/netfilter/ip_conntrack_core.c +++ b/net/ipv4/netfilter/ip_conntrack_core.c @@ -1354,7 +1354,7 @@ static void free_conntrack_hash(struct list_head *hash, int vmalloced,int size) supposed to kill the mall. */ void ip_conntrack_cleanup(void) { - ip_ct_attach = NULL; + rcu_assign_pointer(ip_ct_attach, NULL); /* This makes sure all current packets have passed through netfilter framework. Roll on, two-stage module @@ -1515,7 +1515,7 @@ int __init ip_conntrack_init(void) write_unlock_bh(&ip_conntrack_lock); /* For use by ipt_REJECT */ - ip_ct_attach = ip_conntrack_attach; + rcu_assign_pointer(ip_ct_attach, ip_conntrack_attach); /* Set up fake conntrack: - to never be deleted, not in any hashes */ diff --git a/net/netfilter/core.c b/net/netfilter/core.c index 291b8c6..ad24d0c 100644 --- a/net/netfilter/core.c +++ b/net/netfilter/core.c @@ -248,9 +248,12 @@ void nf_ct_attach(struct sk_buff *new, struct sk_buff *skb) { void (*attach)(struct sk_buff *, struct sk_buff *); - if (skb->nfct && (attach = ip_ct_attach) != NULL) { - mb(); /* Just to be sure: must be read before executing this */ - attach(new, skb); + if (skb->nfct) { + rcu_read_lock(); + attach = rcu_dereference(ip_ct_attach); + if (attach) + attach(new, skb); + rcu_read_unlock(); } } EXPORT_SYMBOL(nf_ct_attach); diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c index 9b02ec4..59bcab1 100644 --- a/net/netfilter/nf_conntrack_core.c +++ b/net/netfilter/nf_conntrack_core.c @@ -1105,7 +1105,7 @@ void nf_conntrack_cleanup(void) { int i; - ip_ct_attach = NULL; + rcu_assign_pointer(ip_ct_attach, NULL); /* This makes sure all current packets have passed through netfilter framework. Roll on, two-stage module @@ -1273,7 +1273,7 @@ int __init nf_conntrack_init(void) write_unlock_bh(&nf_conntrack_lock); /* For use by REJECT target */ - ip_ct_attach = __nf_conntrack_attach; + rcu_assign_pointer(ip_ct_attach, __nf_conntrack_attach); /* Set up fake conntrack: - to never be deleted, not in any hashes */ |
