6 files changed, 25 insertions, 13 deletions

diff --git a/net/bridge/netfilter/ebt_ulog.c b/net/bridge/netfilter/ebt_ulog.c
index 518093802d1d..7c470c371e14 100644
--- a/net/bridge/netfilter/ebt_ulog.c
+++ b/net/bridge/netfilter/ebt_ulog.c
@@ -181,6 +181,7 @@ static void ebt_ulog_packet(struct net *net, unsigned int hooknr,
         ub->qlen++;
 
         pm = nlmsg_data(nlh);
+        memset(pm, 0, sizeof(*pm));
 
         /* Fill in the ulog data */
         pm->version = EBT_ULOG_VERSION;
@@ -193,8 +194,6 @@ static void ebt_ulog_packet(struct net *net, unsigned int hooknr,
         pm->hook = hooknr;
         if (uloginfo->prefix != NULL)
                 strcpy(pm->prefix, uloginfo->prefix);
-        else
-                *(pm->prefix) = '\0';
 
         if (in) {
                 strcpy(pm->physindev, in->name);
@@ -204,16 +203,14 @@ static void ebt_ulog_packet(struct net *net, unsigned int hooknr,
                         strcpy(pm->indev, br_port_get_rcu(in)->br->dev->name);
                 else
                         strcpy(pm->indev, in->name);
-        } else
-                pm->indev[0] = pm->physindev[0] = '\0';
+        }
 
         if (out) {
                 /* If out exists, then out is a bridge port */
                 strcpy(pm->physoutdev, out->name);
                 /* rcu_read_lock()ed by nf_hook_slow */
                 strcpy(pm->outdev, br_port_get_rcu(out)->br->dev->name);
-        } else
-                pm->outdev[0] = pm->physoutdev[0] = '\0';
+        }
 
         if (skb_copy_bits(skb, -ETH_HLEN, pm->data, copy_len) < 0)
                 BUG();
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 85a4f21aac1a..59da7cde0724 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -271,6 +271,11 @@ unsigned int arpt_do_table(struct sk_buff *skb,
         local_bh_disable();
         addend = xt_write_recseq_begin();
         private = table->private;
+        /*
+         * Ensure we load private-> members after we've fetched the base
+         * pointer.
+         */
+        smp_read_barrier_depends();
         table_base = private->entries[smp_processor_id()];
 
         e = get_entry(table_base, private->hook_entry[hook]);
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index d23118d95ff9..718dfbd30cbe 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -327,6 +327,11 @@ ipt_do_table(struct sk_buff *skb,
         addend = xt_write_recseq_begin();
         private = table->private;
         cpu        = smp_processor_id();
+        /*
+         * Ensure we load private-> members after we've fetched the base
+         * pointer.
+         */
+        smp_read_barrier_depends();
         table_base = private->entries[cpu];
         jumpstack  = (struct ipt_entry **)private->jumpstack[cpu];
         stackptr   = per_cpu_ptr(private->stackptr, cpu);
diff --git a/net/ipv4/netfilter/ipt_ULOG.c b/net/ipv4/netfilter/ipt_ULOG.c
index cbc22158af49..9cb993cd224b 100644
--- a/net/ipv4/netfilter/ipt_ULOG.c
+++ b/net/ipv4/netfilter/ipt_ULOG.c
@@ -220,6 +220,7 @@ static void ipt_ulog_packet(struct net *net,
         ub->qlen++;
 
         pm = nlmsg_data(nlh);
+        memset(pm, 0, sizeof(*pm));
 
         /* We might not have a timestamp, get one */
         if (skb->tstamp.tv64 == 0)
@@ -238,8 +239,6 @@ static void ipt_ulog_packet(struct net *net,
         }
         else if (loginfo->prefix[0] != '\0')
                 strncpy(pm->prefix, loginfo->prefix, sizeof(pm->prefix));
-        else
-                *(pm->prefix) = '\0';
 
         if (in && in->hard_header_len > 0 &&
             skb->mac_header != skb->network_header &&
@@ -251,13 +250,9 @@ static void ipt_ulog_packet(struct net *net,
 
         if (in)
                 strncpy(pm->indev_name, in->name, sizeof(pm->indev_name));
-        else
-                pm->indev_name[0] = '\0';
 
         if (out)
                 strncpy(pm->outdev_name, out->name, sizeof(pm->outdev_name));
-        else
-                pm->outdev_name[0] = '\0';
 
         /* copy_len <= skb->len, so can't fail. */
         if (skb_copy_bits(skb, 0, pm->payload, copy_len) < 0)
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 44400c216dc6..710238f58aa9 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -349,6 +349,11 @@ ip6t_do_table(struct sk_buff *skb,
         local_bh_disable();
         addend = xt_write_recseq_begin();
         private = table->private;
+        /*
+         * Ensure we load private-> members after we've fetched the base
+         * pointer.
+         */
+        smp_read_barrier_depends();
         cpu        = smp_processor_id();
         table_base = private->entries[cpu];
         jumpstack  = (struct ip6t_entry **)private->jumpstack[cpu];
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index 8b03028cca69..227aa11e8409 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -845,8 +845,13 @@ xt_replace_table(struct xt_table *table,
                 return NULL;
         }
 
-        table->private = newinfo;
         newinfo->initial_entries = private->initial_entries;
+        /*
+         * Ensure contents of newinfo are visible before assigning to
+         * private.
+         */
+        smp_wmb();
+        table->private = newinfo;
 
         /*
          * Even though table entries have now been swapped, other CPU's