• F
    netfilter: nfnetlink_{log,queue}: Register pernet in first place · 3bfe0498
    Francesco Ruggeri 提交于
    nfnetlink_{log,queue}_init() register the netlink callback nf*_rcv_nl_event
    before registering the pernet_subsys, but the callback relies on data
    structures allocated by pernet init functions.
    
    When nfnetlink_{log,queue} is loaded, if a netlink message is received after
    the netlink callback is registered but before the pernet_subsys is registered,
    the kernel will panic in the sequence
    
    nfulnl_rcv_nl_event
      nfnl_log_pernet
        net_generic
          BUG_ON(id == 0)  where id is nfnl_log_net_id.
    
    The panic can be easily reproduced in 4.0.3 by:
    
    while true ;do modprobe nfnetlink_log ; rmmod nfnetlink_log ; done &
    while true ;do ip netns add dummy ; ip netns del dummy ; done &
    
    This patch moves register_pernet_subsys to earlier in nfnetlink_log_init.
    
    Notice that the BUG_ON hit in 4.0.3 was recently removed in 2591ffd3
    ["netns: remove BUG_ONs from net_generic()"].
    Signed-off-by: NFrancesco Ruggeri <fruggeri@arista.com>
    Signed-off-by: NPablo Neira Ayuso <pablo@netfilter.org>
    3bfe0498
nfnetlink_log.c 27.0 KB