diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2011-01-24 19:01:07 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2011-02-24 14:54:36 -0800 |
| commit | ec2e8ab605d6a5d17f9b4c8db86f9594b2453280 (patch) | |
| tree | 05500f2732f1a303d3ecce098d41f4f99702798b | |
| parent | 5f72ca2a4c4b60e69b07e6ceecc505e47aba060a (diff) | |
| download | linux-hpc-ec2e8ab605d6a5d17f9b4c8db86f9594b2453280.tar.gz | |
netfilter: ctnetlink: fix missing refcount increment during dumps
commit c71caf4114a0e1da3451cc92fba6a152929cd4c2 upstream.
In 13ee6ac netfilter: fix race in conntrack between dump_table and
destroy, we recovered spinlocks to protect the dump of the conntrack
table according to reports from Stephen and acknowledgments on the
issue from Eric.
In that patch, the refcount bump that allows to keep a reference
to the current ct object was removed. However, we still decrement
the refcount for that object in the output path of
ctnetlink_dump_table():
if (last)
nf_ct_put(last)
Cc: Stephen Hemminger <stephen.hemminger@vyatta.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| -rw-r--r-- | net/netfilter/nf_conntrack_netlink.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c index d57dcdb4d22be4..742a6dc08d0c27 100644 --- a/net/netfilter/nf_conntrack_netlink.c +++ b/net/netfilter/nf_conntrack_netlink.c @@ -664,6 +664,7 @@ restart: if (ctnetlink_fill_info(skb, NETLINK_CB(cb->skb).pid, cb->nlh->nlmsg_seq, IPCTNL_MSG_CT_NEW, ct) < 0) { + nf_conntrack_get(&ct->ct_general); cb->args[1] = (unsigned long)ct; goto out; } |