OSDN Git Service

netfilter: nf_conncount: move all list iterations under spinlock
authorPablo Neira Ayuso <pablo@netfilter.org>
Fri, 28 Dec 2018 00:24:47 +0000 (01:24 +0100)
committerPablo Neira Ayuso <pablo@netfilter.org>
Sat, 29 Dec 2018 01:45:21 +0000 (02:45 +0100)
commit2f971a8f425545da52ca0e6bee81f5b1ea0ccc5f
tree0b62fd460a49546309f6684ef2a6d09547b50862
parentdf4a902509766897f7371fdfa4c3bf8bc321b55d
netfilter: nf_conncount: move all list iterations under spinlock

Two CPUs may race to remove a connection from the list, the existing
conn->dead will result in a use-after-free. Use the per-list spinlock to
protect list iterations.

As all accesses to the list now happen while holding the per-list lock,
we no longer need to delay free operations with rcu.

Joint work with Florian.

Fixes: 5c789e131cbb9 ("netfilter: nf_conncount: Add list lock and gc worker, and RCU for init tree search")
Reviewed-by: Shawn Bohrer <sbohrer@cloudflare.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/netfilter/nf_conncount.c