diff options
| author | Mark Huang <mlhuang@cs.princeton.edu> | 2006-08-13 18:57:54 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2006-08-13 18:57:54 -0700 |
| commit | dcb7cd97f133f7cfbd181149a1e60215a869f895 (patch) | |
| tree | 73e600aa19051981a566ad55ca5fa6f9acec4f7a /net/bridge | |
| parent | 0eff66e625306a794ecba4b29ed12f7a147ce219 (diff) | |
| download | kernel_goldelico_gta04-dcb7cd97f133f7cfbd181149a1e60215a869f895.zip kernel_goldelico_gta04-dcb7cd97f133f7cfbd181149a1e60215a869f895.tar.gz kernel_goldelico_gta04-dcb7cd97f133f7cfbd181149a1e60215a869f895.tar.bz2 | |
[NETFILTER]: ulog: fix panic on SMP kernels
Fix kernel panic on various SMP machines. The culprit is a null
ub->skb in ulog_send(). If ulog_timer() has already been scheduled on
one CPU and is spinning on the lock, and ipt_ulog_packet() flushes the
queue on another CPU by calling ulog_send() right before it exits,
there will be no skbuff when ulog_timer() acquires the lock and calls
ulog_send(). Cancelling the timer in ulog_send() doesn't help because
it has already been scheduled and is running on the first CPU.
Similar problem exists in ebt_ulog.c and nfnetlink_log.c.
Signed-off-by: Mark Huang <mlhuang@cs.princeton.edu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/bridge')
| -rw-r--r-- | net/bridge/netfilter/ebt_ulog.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/net/bridge/netfilter/ebt_ulog.c b/net/bridge/netfilter/ebt_ulog.c index 02693a2..9f950db 100644 --- a/net/bridge/netfilter/ebt_ulog.c +++ b/net/bridge/netfilter/ebt_ulog.c @@ -74,6 +74,9 @@ static void ulog_send(unsigned int nlgroup) if (timer_pending(&ub->timer)) del_timer(&ub->timer); + if (!ub->skb) + return; + /* last nlmsg needs NLMSG_DONE */ if (ub->qlen > 1) ub->lastnlh->nlmsg_type = NLMSG_DONE; |