linux/net/netfilter
Florian Westphal af370ab36f netfilter: nf_queue: do not release refcouts until nf_reinject is done
nf_queue is problematic when another NF_QUEUE invocation happens
from nf_reinject().

1. nf_queue is invoked, increments state->sk refcount.
2. skb is queued, waiting for verdict.
3. sk is closed/released.
3. verdict comes back, nf_reinject is called.
4. nf_reinject drops the reference -- refcount can now drop to 0

Instead of get_ref/release_ref pattern, we need to nest the get_ref calls:
    get_ref
       get_ref
       release_ref
     release_ref

So that when we invoke the next processing stage (another netfilter
or the okfn()), we hold at least one reference count on the
devices/socket.

After previous patch, it is now safe to put the entry even after okfn()
has potentially free'd the skb.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2020-03-29 16:28:29 +02:00
..
2019-12-09 10:36:44 -08:00
2019-12-09 10:36:44 -08:00
2019-12-09 10:36:44 -08:00
2019-12-09 10:36:44 -08:00
2019-11-05 14:03:11 -08:00
2020-03-15 15:20:16 +01:00
2019-11-15 23:44:45 +01:00