]> git.karo-electronics.de Git - linux-beck.git/commit
netfilter: fix race in conntrack between dump_table and destroy
authorStephen Hemminger <shemminger@vyatta.com>
Tue, 11 Jan 2011 22:54:42 +0000 (23:54 +0100)
committerPablo Neira Ayuso <pablo@netfilter.org>
Tue, 11 Jan 2011 22:54:42 +0000 (23:54 +0100)
commit13ee6ac579574a2a95e982b19920fd2495dce8cd
treeb1cfcae34d29ce1494254d814fc92e23a426ef71
parent83723d60717f8da0f53f91cf42a845ed56c09662
netfilter: fix race in conntrack between dump_table and destroy

The netlink interface to dump the connection tracking table has a race
when entries are deleted at the same time. A customer reported a crash
and the backtrace showed thatctnetlink_dump_table was running while a
conntrack entry was being destroyed.
(see https://bugzilla.vyatta.com/show_bug.cgi?id=6402).

According to RCU documentation, when using hlist_nulls the reader
must handle the case of seeing a deleted entry and not proceed
further down the linked list.  The old code would continue
which caused the scan to walk into the free list.

This patch uses locking (rather than RCU) for this operation which
is guaranteed safe, and no longer requires getting reference while
doing dump operation.

Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/netfilter/nf_conntrack_netlink.c