netfilter: ctnetlink: make it safer when checking the ct helper name
authorLiping Zhang <zlpnobody@gmail.com>
Sat, 1 Apr 2017 12:55:44 +0000 (20:55 +0800)
committerPablo Neira Ayuso <pablo@netfilter.org>
Sat, 8 Apr 2017 21:52:16 +0000 (23:52 +0200)
commit3173d5b8c89e67fa3176292ff9af06f09f365348
tree003c7716e5989830dfe5d1fff85718929d852a39
parent8b5995d0633b04f9a0d321a7cc77e386440730cf
netfilter: ctnetlink: make it safer when checking the ct helper name

One CPU is doing ctnetlink_change_helper(), while another CPU is doing
unhelp() at the same time. So even if help->helper is not NULL at first,
the later statement strcmp(help->helper->name, ...) may still access
the NULL pointer.

So we must use rcu_read_lock and rcu_dereference to avoid such _bad_
thing happen.

Fixes: f95d7a46bc57 ("netfilter: ctnetlink: Fix regression in CTA_HELP processing")
Signed-off-by: Liping Zhang <zlpnobody@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/netfilter/nf_conntrack_netlink.c