On Wed, Feb 24, 2016 at 09:19:26PM +0100, Jozsef Kadlecsik wrote: > Flushing/listing entries was not RCU safe, so parallel flush/dump > could lead to kernel crash. Bug reported by Deniz Eren. > > Fixes netfilter bugzilla id #1050. > > Signed-off-by: Jozsef Kadlecsik <kadlec@xxxxxxxxxxxxxxxxx> > --- > net/netfilter/ipset/ip_set_core.c | 3 ++ > net/netfilter/ipset/ip_set_list_set.c | 55 ++++++++++++++++------------------- > 2 files changed, 28 insertions(+), 30 deletions(-) > > diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c > index 95db43f..7e6568c 100644 > --- a/net/netfilter/ipset/ip_set_core.c > +++ b/net/netfilter/ipset/ip_set_core.c > @@ -985,6 +985,9 @@ static int ip_set_destroy(struct net *net, struct sock *ctnl, > if (unlikely(protocol_failed(attr))) > return -IPSET_ERR_PROTOCOL; > > + /* Must wait for flush to be really finished in list:set */ > + rcu_barrier(); Jozsef, are you sure you need this rcu_barrier()? This is waiting for rcu callback completion (ie. decrement the set reference counter and releasing the extension and object itself). The rcu read side should be safe when accessing old copies from the dumping path when using call_rcu(). Let me know, thanks! -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
