Re: [PATCH nf-next v2 1/2] netfilter: Fix potential null pointer dereference

Hi Liping,

On Wed, Sep 28, 2016 at 11:13 AM, Liping Zhang [off-list ref] wrote:

2016-09-28 11:08 GMT+08:00 Liping Zhang [off-list ref]:

quoted

Hi Feng,

2016-09-28 9:23 GMT+08:00 Feng Gao [off-list ref]:

quoted

Hi Aaraon,

On Tue, Sep 27, 2016 at 9:38 PM, Aaron Conole [off-list ref] wrote:

quoted

It's possible for nf_hook_entry_head to return NULL if two
nf_unregister_net_hook calls happen simultaneously with a single hook

The critical region of nf_unregister_net_hook is protected by &nf_hook_mutex.
When it would be called simultaneously?

This is unrelated to race condition.

Suppose that only the last nf_hook_entry exist, and two callers want to do
un-register work.

The first one will remove it successfully, after the end of the work, the
second one will enter the critical section, but it will see the NULL pointer.
Because the last nf_hook_entry was already removed by the first one.

quoted

Regards
Feng

quoted

entry in the list.  This fix ensures that no null pointer dereference
could occur when such a race happens.

Signed-off-by: Aaron Conole <redacted>

I read the commit log again, I think the description here is a
little confusing indeed.

Yes. I doesn't check if the list head always exists, just learn the
patch from commit log.
It confuses me indeed.

Regards
Feng