mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-27 12:57:53 +00:00
netfilter: flowtable: prefer refcount_inc
With refcount_inc_not_zero, we'd also need a smp_rmb or similar, followed by a test of the CONFIRMED bit. However, the ct pointer is taken from skb->_nfct, its refcount must not be 0 (else, we'd already have a use-after-free bug). Use refcount_inc() instead to clarify the ct refcount is expected to be at least 1. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
parent
5787db7c90
commit
f02e7dc4cf
1 changed files with 3 additions and 8 deletions
|
@ -53,14 +53,14 @@ struct flow_offload *flow_offload_alloc(struct nf_conn *ct)
|
|||
{
|
||||
struct flow_offload *flow;
|
||||
|
||||
if (unlikely(nf_ct_is_dying(ct) ||
|
||||
!refcount_inc_not_zero(&ct->ct_general.use)))
|
||||
if (unlikely(nf_ct_is_dying(ct)))
|
||||
return NULL;
|
||||
|
||||
flow = kzalloc(sizeof(*flow), GFP_ATOMIC);
|
||||
if (!flow)
|
||||
goto err_ct_refcnt;
|
||||
return NULL;
|
||||
|
||||
refcount_inc(&ct->ct_general.use);
|
||||
flow->ct = ct;
|
||||
|
||||
flow_offload_fill_dir(flow, FLOW_OFFLOAD_DIR_ORIGINAL);
|
||||
|
@ -72,11 +72,6 @@ struct flow_offload *flow_offload_alloc(struct nf_conn *ct)
|
|||
__set_bit(NF_FLOW_DNAT, &flow->flags);
|
||||
|
||||
return flow;
|
||||
|
||||
err_ct_refcnt:
|
||||
nf_ct_put(ct);
|
||||
|
||||
return NULL;
|
||||
}
|
||||
EXPORT_SYMBOL_GPL(flow_offload_alloc);
|
||||
|
||||
|
|
Loading…
Reference in a new issue