| commit | 15cdeadaa5d76009e20c7792aed69f5a73808f97 | [log] [tgz] |
|---|---|---|
| author | Eric Dumazet <eric.dumazet@gmail.com> | Tue Sep 21 21:17:32 2010 +0000 |
| committer | David S. Miller <davem@davemloft.net> | Wed Sep 22 13:13:33 2010 -0700 |
| tree | 11eb05f550c046b3099d52df146948dce0c12635 | |
| parent | b46ffb854554ff939701bdd492b81558da5706fc [diff] |
netfilter: fix a race in nf_ct_ext_create() As soon as rcu_read_unlock() is called, there is no guarantee current thread can safely derefence t pointer, rcu protected. Fix is to copy t->alloc_size in a temporary variable. Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Reviewed-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>