diff options
| author | Eric Dumazet <eric.dumazet@gmail.com> | 2010-09-21 21:17:32 (GMT) |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2010-09-22 20:13:33 (GMT) |
| commit | 15cdeadaa5d76009e20c7792aed69f5a73808f97 (patch) | |
| tree | 11eb05f550c046b3099d52df146948dce0c12635 /net/ipv4/netfilter | |
| parent | b46ffb854554ff939701bdd492b81558da5706fc (diff) | |
| download | linux-fsl-qoriq-15cdeadaa5d76009e20c7792aed69f5a73808f97.tar.xz | |
netfilter: fix a race in nf_ct_ext_create()
As soon as rcu_read_unlock() is called, there is no guarantee current
thread can safely derefence t pointer, rcu protected.
Fix is to copy t->alloc_size in a temporary variable.
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Reviewed-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv4/netfilter')
0 files changed, 0 insertions, 0 deletions