aboutsummaryrefslogtreecommitdiffstats
path: root/net/netfilter
diff options
context:
space:
mode:
authorPatrick McHardy <kaber@trash.net>2007-02-12 11:09:19 -0800
committerDavid S. Miller <davem@davemloft.net>2007-02-12 11:09:19 -0800
commitc3a47ab3e5ad62601449e4e5401352271b777e28 (patch)
tree3b3f6810796367efa5f76209aed12bec6c6a8b17 /net/netfilter
parentMerge branch 'for-linus' of git://git390.osdl.marist.edu/pub/scm/linux-2.6 (diff)
downloadlinux-dev-c3a47ab3e5ad62601449e4e5401352271b777e28.tar.xz
linux-dev-c3a47ab3e5ad62601449e4e5401352271b777e28.zip
[NETFILTER]: Properly use RCU in nf_ct_attach
Use rcu_assign_pointer/rcu_dereference for ip_ct_attach pointer instead of self-made RCU and use rcu_read_lock to make sure the conntrack module doesn't disappear below us while calling it, since this function can be called from outside the netfilter hooks. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/netfilter')
-rw-r--r--net/netfilter/core.c9
-rw-r--r--net/netfilter/nf_conntrack_core.c4
2 files changed, 8 insertions, 5 deletions
diff --git a/net/netfilter/core.c b/net/netfilter/core.c
index 291b8c6862f1..ad24d0c005e2 100644
--- a/net/netfilter/core.c
+++ b/net/netfilter/core.c
@@ -248,9 +248,12 @@ void nf_ct_attach(struct sk_buff *new, struct sk_buff *skb)
{
void (*attach)(struct sk_buff *, struct sk_buff *);
- if (skb->nfct && (attach = ip_ct_attach) != NULL) {
- mb(); /* Just to be sure: must be read before executing this */
- attach(new, skb);
+ if (skb->nfct) {
+ rcu_read_lock();
+ attach = rcu_dereference(ip_ct_attach);
+ if (attach)
+ attach(new, skb);
+ rcu_read_unlock();
}
}
EXPORT_SYMBOL(nf_ct_attach);
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 9b02ec4012fb..59bcab1d1084 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -1105,7 +1105,7 @@ void nf_conntrack_cleanup(void)
{
int i;
- ip_ct_attach = NULL;
+ rcu_assign_pointer(ip_ct_attach, NULL);
/* This makes sure all current packets have passed through
netfilter framework. Roll on, two-stage module
@@ -1273,7 +1273,7 @@ int __init nf_conntrack_init(void)
write_unlock_bh(&nf_conntrack_lock);
/* For use by REJECT target */
- ip_ct_attach = __nf_conntrack_attach;
+ rcu_assign_pointer(ip_ct_attach, __nf_conntrack_attach);
/* Set up fake conntrack:
- to never be deleted, not in any hashes */