nfq_open_nfnl uses an intermediate static object, so when
it is invoked by distinct threads at the same time there is a small
chance that some threads end up with another threads nfq_handle pointer
stored in ->data.
Tested-by: Michal Tesar <mtesar@xxxxxxxxxx>
Signed-off-by: Florian Westphal <fw@xxxxxxxxx>
---
src/libnetfilter_queue.c | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)
diff --git a/src/libnetfilter_queue.c b/src/libnetfilter_queue.c
index 740b340..ce16f95 100644
--- a/src/libnetfilter_queue.c
+++ b/src/libnetfilter_queue.c
@@ -216,11 +216,6 @@ static int __nfq_rcv_pkt(struct nlmsghdr *nlh, struct nfattr *nfa[],
return qh->cb(qh, nfmsg, &nfqa, qh->data);
}
-static struct nfnl_callback pkt_cb = {
- .call = &__nfq_rcv_pkt,
- .attr_count = NFQA_MAX,
-};
-
/* public interface */
struct nfnl_handle *nfq_nfnlh(struct nfq_handle *h)
@@ -389,6 +384,10 @@ EXPORT_SYMBOL(nfq_open);
*/
struct nfq_handle *nfq_open_nfnl(struct nfnl_handle *nfnlh)
{
+ struct nfnl_callback pkt_cb = {
+ .call = __nfq_rcv_pkt,
+ .attr_count = NFQA_MAX,
+ };
struct nfq_handle *h;
int err;
--
2.7.3
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
