• N
    [IPVS]: Close race conditions on ip_vs_conn_tab list modification · fb3d8949
    Neil Horman 提交于
    In an smp system, it is possible for an connection timer to expire, calling
    ip_vs_conn_expire while the connection table is being flushed, before
    ct_write_lock_bh is acquired.
    
    Since the list iterator loop in ip_vs_con_flush releases and re-acquires the
    spinlock (even though it doesn't re-enable softirqs), it is possible for the
    expiration function to modify the connection list, while it is being traversed
    in ip_vs_conn_flush.
    
    The result is that the next pointer gets set to NULL, and subsequently
    dereferenced, resulting in an oops.
    Signed-off-by: NNeil Horman <nhorman@redhat.com>
    Acked-by: JulianAnastasov
    Signed-off-by: NDavid S. Miller <davem@davemloft.net>
    fb3d8949
ip_vs_conn.c 21.4 KB