* [PATCH] xt_hashlimit: fix race between htable_destroy and htable_gc
@ 2008-07-23 21:51 Pavel Emelyanov
2008-07-30 10:53 ` Patrick McHardy
0 siblings, 1 reply; 2+ messages in thread
From: Pavel Emelyanov @ 2008-07-23 21:51 UTC (permalink / raw)
To: David Miller, Patrick McHardy
Cc: Linux Netdev List, Netfilter Development Mailinglist
Deleting a timer with del_timer doesn't guarantee, that the
timer function is not running at the moment of deletion. Thus
in the xt_hashlimit case we can get into a ticklish situation
when the htable_gc rearms the timer back and we'll actually
delete an entry with a pending timer.
Fix it with using del_timer_sync().
AFAIK del_timer_sync checks for the timer to be pending by
itself, so I remove the check.
Signed-off-by: Pavel Emelyanov <xemul@openvz.org>
---
diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index 6809af5..d9418a2 100644
--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c
@@ -367,9 +367,7 @@ static void htable_gc(unsigned long htlong)
static void htable_destroy(struct xt_hashlimit_htable *hinfo)
{
- /* remove timer, if it is pending */
- if (timer_pending(&hinfo->timer))
- del_timer(&hinfo->timer);
+ del_timer_sync(&hinfo->timer);
/* remove proc entry */
remove_proc_entry(hinfo->pde->name,
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] xt_hashlimit: fix race between htable_destroy and htable_gc
2008-07-23 21:51 [PATCH] xt_hashlimit: fix race between htable_destroy and htable_gc Pavel Emelyanov
@ 2008-07-30 10:53 ` Patrick McHardy
0 siblings, 0 replies; 2+ messages in thread
From: Patrick McHardy @ 2008-07-30 10:53 UTC (permalink / raw)
To: Pavel Emelyanov
Cc: David Miller, Linux Netdev List,
Netfilter Development Mailinglist
Pavel Emelyanov wrote:
> Deleting a timer with del_timer doesn't guarantee, that the
> timer function is not running at the moment of deletion. Thus
> in the xt_hashlimit case we can get into a ticklish situation
> when the htable_gc rearms the timer back and we'll actually
> delete an entry with a pending timer.
>
> Fix it with using del_timer_sync().
>
> AFAIK del_timer_sync checks for the timer to be pending by
> itself, so I remove the check.
Also applied, thanks.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2008-07-30 10:53 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2008-07-23 21:51 [PATCH] xt_hashlimit: fix race between htable_destroy and htable_gc Pavel Emelyanov
2008-07-30 10:53 ` Patrick McHardy
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).