diff options
author | Patrick McHardy <kaber@trash.net> | 2011-02-14 11:35:07 -0500 |
---|---|---|
committer | Patrick McHardy <kaber@trash.net> | 2011-02-14 11:35:07 -0500 |
commit | de9963f0f2dfad128b26ae7bf6005f5948416a6d (patch) | |
tree | 73b45541d33e86600cd10e4be43298864f2b6a1a /net | |
parent | c317428644c0af137d80069ab178cd797da3be45 (diff) |
netfilter: nf_iterate: fix incorrect RCU usage
As noticed by Eric, nf_iterate doesn't use RCU correctly by
accessing the prev pointer of a RCU protected list element when
a verdict of NF_REPEAT is issued.
Fix by jumping backwards to the hook invocation directly instead
of loading the previous list element before continuing the list
iteration.
Reported-by: Eric Dumazet <eric.dumazet@gmail.com>
Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Diffstat (limited to 'net')
-rw-r--r-- | net/netfilter/core.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/net/netfilter/core.c b/net/netfilter/core.c index 32fcbe290c0..4aa614b8a96 100644 --- a/net/netfilter/core.c +++ b/net/netfilter/core.c | |||
@@ -133,6 +133,7 @@ unsigned int nf_iterate(struct list_head *head, | |||
133 | 133 | ||
134 | /* Optimization: we don't need to hold module | 134 | /* Optimization: we don't need to hold module |
135 | reference here, since function can't sleep. --RR */ | 135 | reference here, since function can't sleep. --RR */ |
136 | repeat: | ||
136 | verdict = elem->hook(hook, skb, indev, outdev, okfn); | 137 | verdict = elem->hook(hook, skb, indev, outdev, okfn); |
137 | if (verdict != NF_ACCEPT) { | 138 | if (verdict != NF_ACCEPT) { |
138 | #ifdef CONFIG_NETFILTER_DEBUG | 139 | #ifdef CONFIG_NETFILTER_DEBUG |
@@ -145,7 +146,7 @@ unsigned int nf_iterate(struct list_head *head, | |||
145 | #endif | 146 | #endif |
146 | if (verdict != NF_REPEAT) | 147 | if (verdict != NF_REPEAT) |
147 | return verdict; | 148 | return verdict; |
148 | *i = (*i)->prev; | 149 | goto repeat; |
149 | } | 150 | } |
150 | } | 151 | } |
151 | return NF_ACCEPT; | 152 | return NF_ACCEPT; |