diff options
| author | Stephen Hemminger <shemminger@vyatta.com> | 2011-01-11 23:54:42 +0100 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2011-01-11 23:54:42 +0100 |
| commit | 13ee6ac579574a2a95e982b19920fd2495dce8cd (patch) | |
| tree | b1cfcae34d29ce1494254d814fc92e23a426ef71 /net/caif/chnl_net.c | |
| parent | 83723d60717f8da0f53f91cf42a845ed56c09662 (diff) | |
| download | op-kernel-dev-13ee6ac579574a2a95e982b19920fd2495dce8cd.zip op-kernel-dev-13ee6ac579574a2a95e982b19920fd2495dce8cd.tar.gz | |
netfilter: fix race in conntrack between dump_table and destroy
The netlink interface to dump the connection tracking table has a race
when entries are deleted at the same time. A customer reported a crash
and the backtrace showed thatctnetlink_dump_table was running while a
conntrack entry was being destroyed.
(see https://bugzilla.vyatta.com/show_bug.cgi?id=6402).
According to RCU documentation, when using hlist_nulls the reader
must handle the case of seeing a deleted entry and not proceed
further down the linked list. The old code would continue
which caused the scan to walk into the free list.
This patch uses locking (rather than RCU) for this operation which
is guaranteed safe, and no longer requires getting reference while
doing dump operation.
Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/caif/chnl_net.c')
0 files changed, 0 insertions, 0 deletions
