Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fa9a86dd authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller
Browse files

netfilter: use rcu_read_bh() in ipt_do_table() 



Commit 78454473
(netfilter: iptables: lock free counters) forgot to disable BH
in arpt_do_table(), ipt_do_table() and  ip6t_do_table()

Use rcu_read_lock_bh() instead of rcu_read_lock() cures the problem.

Reported-and-bisected-by: default avatarRoman Mindalev <r000n@r000n.net>
Signed-off-by: default avatarEric Dumazet <dada1@cosmosbay.com>
Acked-by: default avatarPatrick McHardy <kaber@trash.net>
Acked-by: default avatarStephen Hemminger <shemminger@vyatta.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 8cbd9606

net/ipv4/netfilter/arp_tables.c

+2 −2
Original line number Diff line number Diff line
@@ -253,7 +253,7 @@ unsigned int arpt_do_table(struct sk_buff *skb, 
	indev = in ? in->name : nulldevname;

	outdev = out ? out->name : nulldevname;



	rcu_read_lock();

	rcu_read_lock_bh();

	private = rcu_dereference(table->private);

	table_base = rcu_dereference(private->entries[smp_processor_id()]);
@@ -329,7 +329,7 @@ unsigned int arpt_do_table(struct sk_buff *skb, 
		}

	} while (!hotdrop);



	rcu_read_unlock();

	rcu_read_unlock_bh();



	if (hotdrop)

		return NF_DROP;

net/ipv4/netfilter/ip_tables.c

+2 −2
Original line number Diff line number Diff line
@@ -339,7 +339,7 @@ ipt_do_table(struct sk_buff *skb, 


	IP_NF_ASSERT(table->valid_hooks & (1 << hook));



	rcu_read_lock();

	rcu_read_lock_bh();

	private = rcu_dereference(table->private);

	table_base = rcu_dereference(private->entries[smp_processor_id()]);
@@ -437,7 +437,7 @@ ipt_do_table(struct sk_buff *skb, 
		}

	} while (!hotdrop);



	rcu_read_unlock();

	rcu_read_unlock_bh();



#ifdef DEBUG_ALLOW_ALL

	return NF_ACCEPT;

net/ipv6/netfilter/ip6_tables.c

+2 −2
Original line number Diff line number Diff line
@@ -365,7 +365,7 @@ ip6t_do_table(struct sk_buff *skb, 


	IP_NF_ASSERT(table->valid_hooks & (1 << hook));



	rcu_read_lock();

	rcu_read_lock_bh();

	private = rcu_dereference(table->private);

	table_base = rcu_dereference(private->entries[smp_processor_id()]);
@@ -466,7 +466,7 @@ ip6t_do_table(struct sk_buff *skb, 
#ifdef CONFIG_NETFILTER_DEBUG

	((struct ip6t_entry *)table_base)->comefrom = NETFILTER_LINK_POISON;

#endif

	rcu_read_unlock();

	rcu_read_unlock_bh();



#ifdef DEBUG_ALLOW_ALL

	return NF_ACCEPT;