On Sat, Mar 25, 2017 at 12:09:15PM +0800, Liping Zhang wrote: > From: Liping Zhang <zlpnobody@xxxxxxxxx> > > The nf_ct_helper_hash table is protected by nf_ct_helper_mutex, while > nfct_helper operation is protected by nfnl_lock(NFNL_SUBSYS_CTHELPER). > So it's possible that one CPU is walking the nf_ct_helper_hash for > cthelper add/get/del, another cpu is doing nf_conntrack_helpers_unregister > at the same time. This is dangrous, and may cause use after free error. > > Note, delete operation will flush all cthelpers added via nfnetlink, so > using rcu to do protect is not easy. > > Now introduce a dummy list to record all the cthelpers added via > nfnetlink, then we can walk the dummy list instead of walking the > nf_ct_helper_hash. Also, keep nfnl_cthelper_dump_table unchanged, it > may be invoked without nfnl_lock(NFNL_SUBSYS_CTHELPER) held. Also applied, thanks Liping. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
