Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit dcb7cd97 authored by Mark Huang's avatar Mark Huang Committed by David S. Miller
Browse files

[NETFILTER]: ulog: fix panic on SMP kernels 



Fix kernel panic on various SMP machines. The culprit is a null
ub->skb in ulog_send(). If ulog_timer() has already been scheduled on
one CPU and is spinning on the lock, and ipt_ulog_packet() flushes the
queue on another CPU by calling ulog_send() right before it exits,
there will be no skbuff when ulog_timer() acquires the lock and calls
ulog_send(). Cancelling the timer in ulog_send() doesn't help because
it has already been scheduled and is running on the first CPU.

Similar problem exists in ebt_ulog.c and nfnetlink_log.c.

Signed-off-by: default avatarMark Huang <mlhuang@cs.princeton.edu>
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 0eff66e6

net/bridge/netfilter/ebt_ulog.c

+3 −0
Original line number Diff line number Diff line
@@ -74,6 +74,9 @@ static void ulog_send(unsigned int nlgroup) 
	if (timer_pending(&ub->timer))

		del_timer(&ub->timer);



	if (!ub->skb)

		return;



	/* last nlmsg needs NLMSG_DONE */

	if (ub->qlen > 1)

		ub->lastnlh->nlmsg_type = NLMSG_DONE;

net/ipv4/netfilter/ipt_ULOG.c

+5 −0
Original line number Diff line number Diff line
@@ -115,6 +115,11 @@ static void ulog_send(unsigned int nlgroupnum) 
		del_timer(&ub->timer);

	}



	if (!ub->skb) {

		DEBUGP("ipt_ULOG: ulog_send: nothing to send\n");

		return;

	}



	/* last nlmsg needs NLMSG_DONE */

	if (ub->qlen > 1)

		ub->lastnlh->nlmsg_type = NLMSG_DONE;

net/netfilter/nfnetlink_log.c

+3 −0
Original line number Diff line number Diff line
@@ -366,6 +366,9 @@ __nfulnl_send(struct nfulnl_instance *inst) 
	if (timer_pending(&inst->timer))

		del_timer(&inst->timer);



	if (!inst->skb)

		return 0;



	if (inst->qlen > 1)

		inst->lastnlh->nlmsg_type = NLMSG_DONE;