I wonder nf_conntrack_find_get()
that really protect ct pointer by RCU in linux kernel.
Read-Copy-Update(RCU) can protect to access(read) node rcu_read_side critical section when node is updating. But, it is not mean protect node.
nf_conntrack_find_get()
call ___nf_conntrack_find
.
__nf_conntrack_find
returned h
(rcu potioner).
But another process can access same h and free(h)
.
In this time, eventually I think ct is not protected.
h
is used calculate to offset and get ct pointer.
Could we think h
or ct
is safe?
Below is the code..
/net/netfilter/nf_conntrack_core.c:
__nf_conntrack_find_get() {
rcu_read_lock();
h = ____nf_conntrack_find(net, zone, tuple, hash);
if (h) {
// RCU can't protect free h. only ensures to read old copy.
// If another processor free same h, h is freed.
// is really h available next line?
ct = nf_ct_tuplehash_to_ctrack(h);
....
}
}
rcu_read_unlock();
I think that if want to protect node(h), have to use call_rcu()
instead of directly free in destroy_conntrack()
.