diff options
| author | Florian Westphal <fw@strlen.de> | 2014-06-08 11:41:23 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2014-07-09 11:21:32 -0700 |
| commit | f211ea001a9c90e02a3a0aa5a90e3a3160301c50 (patch) | |
| tree | ff3d55c641b06817550108e71428b23443f42608 /lib/timerqueue.c | |
| parent | 23517eb3d184cf7731d74215786cd7ae39da7557 (diff) | |
netfilter: ctnetlink: fix refcnt leak in dying/unconfirmed list dumper
commit cd5f336f1780cb20e83146cde64d3d5779e175e6 upstream.
'last' keeps track of the ct that had its refcnt bumped during previous
dump cycle. Thus it must not be overwritten until end-of-function.
Another (unrelated, theoretical) issue: Don't attempt to bump refcnt of a conntrack
whose reference count is already 0. Such conntrack is being destroyed
right now, its memory is freed once we release the percpu dying spinlock.
Fixes: b7779d06 ('netfilter: conntrack: spinlock per cpu to protect special lists.')
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'lib/timerqueue.c')
0 files changed, 0 insertions, 0 deletions