commit 9c3f3794926a997b1cab6c42480ff300efa2d162
Author: Liping Zhang <email address hidden>
Date: Sat Mar 25 16:35:29 2017 +0800
netfilter: nf_ct_ext: fix possible panic after nf_ct_extend_unregister
If one cpu is doing nf_ct_extend_unregister while another cpu is doing
__nf_ct_ext_add_length, then we may hit BUG_ON(t == NULL). Moreover,
there's no synchronize_rcu invocation after set nf_ct_ext_types[id] to
NULL, so it's possible that we may access invalid pointer.
[...]
The panic appears to be fixed upstream via:
commit 9c3f3794926a997 b1cab6c42480ff3 00efa2d162
Author: Liping Zhang <email address hidden>
Date: Sat Mar 25 16:35:29 2017 +0800
netfilter: nf_ct_ext: fix possible panic after nf_ct_extend_ unregister
If one cpu is doing nf_ct_extend_ unregister while another cpu is doing ct_ext_ add_length, then we may hit BUG_ON(t == NULL). Moreover,
__nf_
there's no synchronize_rcu invocation after set nf_ct_ext_types[id] to
NULL, so it's possible that we may access invalid pointer.
[...]