diff options
| author | Michał Mirosław <mirq-linux@rere.qmqm.pl> | 2007-03-24 21:36:24 +0100 |
|---|---|---|
| committer | Adrian Bunk <bunk@stusta.de> | 2007-03-24 21:36:24 +0100 |
| commit | 95a917c1d7f83b89995651cd753008c20bed3302 (patch) | |
| tree | f3d0ed12e5ad78285ae154e9a8bcd9b9722b35d7 /net | |
| parent | 3c927506670aabede5d65e0085384d9108d8d96d (diff) | |
[NETFILTER]: nfnetlink_log: fix use after free
Paranoia: instance_put() might have freed the inst pointer when we
spin_unlock_bh().
Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Diffstat (limited to 'net')
| -rw-r--r-- | net/netfilter/nfnetlink_log.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c index c0a3ca64b9c..d952e646ad5 100644 --- a/net/netfilter/nfnetlink_log.c +++ b/net/netfilter/nfnetlink_log.c @@ -380,8 +380,8 @@ static void nfulnl_timer(unsigned long data) if (timer_pending(&inst->timer)) /* is it always true or false here? */ del_timer(&inst->timer); __nfulnl_send(inst); - instance_put(inst); spin_unlock_bh(&inst->lock); + instance_put(inst); } static inline int |