Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit de9963f0 authored by Patrick McHardy's avatar Patrick McHardy
Browse files

netfilter: nf_iterate: fix incorrect RCU usage 



As noticed by Eric, nf_iterate doesn't use RCU correctly by
accessing the prev pointer of a RCU protected list element when
a verdict of NF_REPEAT is issued.

Fix by jumping backwards to the hook invocation directly instead
of loading the previous list element before continuing the list
iteration.

Reported-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
Acked-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
parent c3174286

net/netfilter/core.c

+2 −1
Original line number Diff line number Diff line
@@ -133,6 +133,7 @@ unsigned int nf_iterate(struct list_head *head, 


		/* Optimization: we don't need to hold module

		   reference here, since function can't sleep. --RR */

repeat:

		verdict = elem->hook(hook, skb, indev, outdev, okfn);

		if (verdict != NF_ACCEPT) {

#ifdef CONFIG_NETFILTER_DEBUG
@@ -145,7 +146,7 @@ unsigned int nf_iterate(struct list_head *head, 
#endif

			if (verdict != NF_REPEAT)

				return verdict;

			*i = (*i)->prev;

			goto repeat;

		}

	}

	return NF_ACCEPT;