[patch 06/31] NETFILTER: nfnetlink_log: fix reference counting

Greg KH
2007-03-19T21:40:30Z

[-- Attachment #1: netfilter-nfnetlink_log-fix-reference-counting.patch --]
[-- Type: text/plain, Size: 1356 bytes --]

-stable review patch. If anyone has any objections, please let us know.

------------------

From: Michal Miroslaw <mirq-linux@rere.qmqm.pl>

[NETFILTER]: nfnetlink_log: fix reference counting

Fix reference counting (memory leak) problem in __nfulnl_send() and callers
related to packet queueing.

Signed-off-by: Michal Miroslaw <mirq-linux@rere.qmqm.pl>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
net/netfilter/nfnetlink_log.c | 8 ++------
1 file changed, 2 insertions(+), 6 deletions(-)

--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -218,10 +218,8 @@ _instance_destroy2(struct nfulnl_instanc
spin_lock_bh(&inst->lock);
if (inst->skb) {
/* timer "holds" one reference (we have one more) */
- if (timer_pending(&inst->timer)) {
- del_timer(&inst->timer);
+ if (del_timer(&inst->timer))
instance_put(inst);
- }
if (inst->qlen)
__nfulnl_send(inst);
if (inst->skb) {
@@ -695,10 +693,8 @@ nfulnl_log_packet(unsigned int pf,
UDEBUG("flushing old skb\n");

/* timer "holds" one reference (we have another one) */
- if (timer_pending(&inst->timer)) {
- del_timer(&inst->timer);
+ if (del_timer(&inst->timer))
instance_put(inst);
- }
__nfulnl_send(inst);

if (!(inst->skb = nfulnl_alloc_skb(nlbufsiz, size))) {

--