• Liping Zhang's avatar
    netfilter: invoke synchronize_rcu after set the _hook_ to NULL · 3b7dabf0
    Liping Zhang authored
    Otherwise, another CPU may access the invalid pointer. For example:
        CPU0                CPU1
         -              rcu_read_lock();
         -              pfunc = _hook_;
      _hook_ = NULL;          -
      mod unload              -
         -                 pfunc(); // invalid, panic
         -             rcu_read_unlock();
    
    So we must call synchronize_rcu() to wait the rcu reader to finish.
    
    Also note, in nf_nat_snmp_basic_fini, synchronize_rcu() will be invoked
    by later nf_conntrack_helper_unregister, but I'm inclined to add a
    explicit synchronize_rcu after set the nf_nat_snmp_hook to NULL. Depend
    on such obscure assumptions is not a good idea.
    
    Last, in nfnetlink_cttimeout, we use kfree_rcu to free the time object,
    so in cttimeout_exit, invoking rcu_barrier() is not necessary at all,
    remove it too.
    Signed-off-by: default avatarLiping Zhang <zlpnobody@gmail.com>
    Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
    3b7dabf0
nf_conntrack_ecache.c 9.86 KB