Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3b7dabf0 authored by Liping Zhang's avatar Liping Zhang Committed by Pablo Neira Ayuso
Browse files

netfilter: invoke synchronize_rcu after set the _hook_ to NULL 



Otherwise, another CPU may access the invalid pointer. For example:
    CPU0                CPU1
     -              rcu_read_lock();
     -              pfunc = _hook_;
  _hook_ = NULL;          -
  mod unload              -
     -                 pfunc(); // invalid, panic
     -             rcu_read_unlock();

So we must call synchronize_rcu() to wait the rcu reader to finish.

Also note, in nf_nat_snmp_basic_fini, synchronize_rcu() will be invoked
by later nf_conntrack_helper_unregister, but I'm inclined to add a
explicit synchronize_rcu after set the nf_nat_snmp_hook to NULL. Depend
on such obscure assumptions is not a good idea.

Last, in nfnetlink_cttimeout, we use kfree_rcu to free the time object,
so in cttimeout_exit, invoking rcu_barrier() is not necessary at all,
remove it too.

Signed-off-by: default avatarLiping Zhang <zlpnobody@gmail.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent f83bf8da

net/ipv4/netfilter/nf_nat_snmp_basic.c

+1 −0
Original line number Diff line number Diff line
@@ -1304,6 +1304,7 @@ static int __init nf_nat_snmp_basic_init(void) 
static void __exit nf_nat_snmp_basic_fini(void)

{

	RCU_INIT_POINTER(nf_nat_snmp_hook, NULL);

	synchronize_rcu();

	nf_conntrack_helper_unregister(&snmp_trap_helper);

}

net/netfilter/nf_conntrack_ecache.c

+2 −0
Original line number Diff line number Diff line
@@ -290,6 +290,7 @@ void nf_conntrack_unregister_notifier(struct net *net, 
	BUG_ON(notify != new);

	RCU_INIT_POINTER(net->ct.nf_conntrack_event_cb, NULL);

	mutex_unlock(&nf_ct_ecache_mutex);

	/* synchronize_rcu() is called from ctnetlink_exit. */

}

EXPORT_SYMBOL_GPL(nf_conntrack_unregister_notifier);
@@ -326,6 +327,7 @@ void nf_ct_expect_unregister_notifier(struct net *net, 
	BUG_ON(notify != new);

	RCU_INIT_POINTER(net->ct.nf_expect_event_cb, NULL);

	mutex_unlock(&nf_ct_ecache_mutex);

	/* synchronize_rcu() is called from ctnetlink_exit. */

}

EXPORT_SYMBOL_GPL(nf_ct_expect_unregister_notifier);

net/netfilter/nf_conntrack_netlink.c

+1 −0
Original line number Diff line number Diff line
@@ -3442,6 +3442,7 @@ static void __exit ctnetlink_exit(void) 
#ifdef CONFIG_NETFILTER_NETLINK_GLUE_CT

	RCU_INIT_POINTER(nfnl_ct_hook, NULL);

#endif

	synchronize_rcu();

}



module_init(ctnetlink_init);

net/netfilter/nf_nat_core.c

+2 −0
Original line number Diff line number Diff line
@@ -903,6 +903,8 @@ static void __exit nf_nat_cleanup(void) 
#ifdef CONFIG_XFRM

	RCU_INIT_POINTER(nf_nat_decode_session_hook, NULL);

#endif

	synchronize_rcu();



	for (i = 0; i < NFPROTO_NUMPROTO; i++)

		kfree(nf_nat_l4protos[i]);

net/netfilter/nfnetlink_cttimeout.c

+1 −1
Original line number Diff line number Diff line
@@ -646,8 +646,8 @@ static void __exit cttimeout_exit(void) 
#ifdef CONFIG_NF_CONNTRACK_TIMEOUT

	RCU_INIT_POINTER(nf_ct_timeout_find_get_hook, NULL);

	RCU_INIT_POINTER(nf_ct_timeout_put_hook, NULL);

	synchronize_rcu();

#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */

	rcu_barrier();

}



module_init(cttimeout_init);