Skip to content

Commit

Permalink
netfilter: nf_iterate: fix incorrect RCU usage
Browse files Browse the repository at this point in the history
As noticed by Eric, nf_iterate doesn't use RCU correctly by
accessing the prev pointer of a RCU protected list element when
a verdict of NF_REPEAT is issued.

Fix by jumping backwards to the hook invocation directly instead
of loading the previous list element before continuing the list
iteration.

Reported-by: Eric Dumazet <eric.dumazet@gmail.com>
Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
  • Loading branch information
Patrick McHardy committed Feb 14, 2011
1 parent c317428 commit de9963f
Showing 1 changed file with 2 additions and 1 deletion.
3 changes: 2 additions & 1 deletion net/netfilter/core.c
Original file line number Diff line number Diff line change
Expand Up @@ -133,6 +133,7 @@ unsigned int nf_iterate(struct list_head *head,

/* Optimization: we don't need to hold module
reference here, since function can't sleep. --RR */
repeat:
verdict = elem->hook(hook, skb, indev, outdev, okfn);
if (verdict != NF_ACCEPT) {
#ifdef CONFIG_NETFILTER_DEBUG
Expand All @@ -145,7 +146,7 @@ unsigned int nf_iterate(struct list_head *head,
#endif
if (verdict != NF_REPEAT)
return verdict;
*i = (*i)->prev;
goto repeat;
}
}
return NF_ACCEPT;
Expand Down

0 comments on commit de9963f

Please sign in to comment.