[NETFILTER]: ip_conntrack: properly use RCU for ip_conntrack_destroyed callback

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/ipv4/netfilter/ip_conntrack_core.c b/net/ipv4/netfilter/ip_conntrack_core.c
index a7e34d007ab01e2d37e2e037ac6ea8b757d9a317..07ba1dd136b5b2e711336cdb0828291d012edc54 100644 (file)
--- a/net/ipv4/netfilter/ip_conntrack_core.c
+++ b/net/ipv4/netfilter/ip_conntrack_core.c
@@ -303,6 +303,7 @@ destroy_conntrack(struct nf_conntrack *nfct)
        struct ip_conntrack *ct = (struct ip_conntrack *)nfct;
        struct ip_conntrack_protocol *proto;
        struct ip_conntrack_helper *helper;
+       typeof(ip_conntrack_destroyed) destroyed;
 
        DEBUGP("destroy_conntrack(%p)\n", ct);
        IP_NF_ASSERT(atomic_read(&nfct->use) == 0);
@@ -322,10 +323,12 @@ destroy_conntrack(struct nf_conntrack *nfct)
        proto = __ip_conntrack_proto_find(ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.protonum);
        if (proto && proto->destroy)
                proto->destroy(ct);
-       rcu_read_unlock();
 
-       if (ip_conntrack_destroyed)
-               ip_conntrack_destroyed(ct);
+       destroyed = rcu_dereference(ip_conntrack_destroyed);
+       if (destroyed)
+               destroyed(ct);
+
+       rcu_read_unlock();
 
        write_lock_bh(&ip_conntrack_lock);
        /* Expectations will have been removed in clean_from_lists,

diff --git a/net/ipv4/netfilter/ip_nat_core.c b/net/ipv4/netfilter/ip_nat_core.c
index 18daabc220695194bf4bf57e427bdcb4de0db9ac..40737fdbe9a73126dd17e59f97371973989c2cfb 100644 (file)
--- a/net/ipv4/netfilter/ip_nat_core.c
+++ b/net/ipv4/netfilter/ip_nat_core.c
@@ -604,8 +604,8 @@ static int __init ip_nat_init(void)
        }
 
        /* FIXME: Man, this is a hack.  <SIGH> */
-       IP_NF_ASSERT(ip_conntrack_destroyed == NULL);
-       ip_conntrack_destroyed = &ip_nat_cleanup_conntrack;
+       IP_NF_ASSERT(rcu_dereference(ip_conntrack_destroyed) == NULL);
+       rcu_assign_pointer(ip_conntrack_destroyed, ip_nat_cleanup_conntrack);
 
        /* Initialize fake conntrack so that NAT will skip it */
        ip_conntrack_untracked.status |= IPS_NAT_DONE_MASK;
@@ -623,7 +623,8 @@ static int clean_nat(struct ip_conntrack *i, void *data)
 static void __exit ip_nat_cleanup(void)
 {
        ip_ct_iterate_cleanup(&clean_nat, NULL);
-       ip_conntrack_destroyed = NULL;
+       rcu_assign_pointer(ip_conntrack_destroyed, NULL);
+       synchronize_rcu();
        vfree(bysource);
 }