Doug / smarc-fsl-linux-kernel

Download as
Browse Code ยป

Commit dcb7cd97f133f7cfbd181149a1e60215a869f895

Authored by Mark Huang
Committed by David S. Miller
1 parent 0eff66e625
Exists in master and in 7 other branches imx_3.0.35_4.1.0, imx_3.10.17_1.0.1_ga, imx_3.10.53_1.1.0_ga, imx_3.14.28_1.0.0_ga, smarc-imx_3.10.53_1.1.0_ga, smarc-imx_3.14.28_1.0.0_ga, smarc-l5.0.0_1.0.0-ga

[NETFILTER]: ulog: fix panic on SMP kernels 

Fix kernel panic on various SMP machines. The culprit is a null
ub->skb in ulog_send(). If ulog_timer() has already been scheduled on
one CPU and is spinning on the lock, and ipt_ulog_packet() flushes the
queue on another CPU by calling ulog_send() right before it exits,
there will be no skbuff when ulog_timer() acquires the lock and calls
ulog_send(). Cancelling the timer in ulog_send() doesn't help because
it has already been scheduled and is running on the first CPU.

Similar problem exists in ebt_ulog.c and nfnetlink_log.c.

Signed-off-by: Mark Huang <mlhuang@cs.princeton.edu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

Showing 3 changed files with 11 additions and 0 deletions Side-by-side Diff

net/bridge/netfilter/ebt_ulog.c
Diff comments   View file @ dcb7cd9
... ... @@ -74,6 +74,9 @@
74 74 if (timer_pending(&ub->timer))
75 75 del_timer(&ub->timer);
76 76  
  77 + if (!ub->skb)
  78 + return;
  79 +
77 80 /* last nlmsg needs NLMSG_DONE */
78 81 if (ub->qlen > 1)
79 82 ub->lastnlh->nlmsg_type = NLMSG_DONE;
net/ipv4/netfilter/ipt_ULOG.c
Diff comments   View file @ dcb7cd9
... ... @@ -115,6 +115,11 @@
115 115 del_timer(&ub->timer);
116 116 }
117 117  
  118 + if (!ub->skb) {
  119 + DEBUGP("ipt_ULOG: ulog_send: nothing to send\n");
  120 + return;
  121 + }
  122 +
118 123 /* last nlmsg needs NLMSG_DONE */
119 124 if (ub->qlen > 1)
120 125 ub->lastnlh->nlmsg_type = NLMSG_DONE;
net/netfilter/nfnetlink_log.c
Diff comments   View file @ dcb7cd9
... ... @@ -366,6 +366,9 @@
366 366 if (timer_pending(&inst->timer))
367 367 del_timer(&inst->timer);
368 368  
  369 + if (!inst->skb)
  370 + return 0;
  371 +
369 372 if (inst->qlen > 1)
370 373 inst->lastnlh->nlmsg_type = NLMSG_DONE;
371 374