Re: [Patch net] ipt_CLUSTERIP: fix a refcount bug in clusterip_config_find_get()

On Thu, Feb 8, 2018 at 12:01 AM, Florian Westphal wrote: > Cong Wang wrote: >> In clusterip_config_find_get() we hold RCU read lock so it could >> run concurrently with clusterip_config_entry_put(), as a result, >> the refcnt could go back to 1 from 0,

Re: [Patch net] ipt_CLUSTERIP: fix a refcount bug in clusterip_config_find_get()

Cong Wang wrote: > In clusterip_config_find_get() we hold RCU read lock so it could > run concurrently with clusterip_config_entry_put(), as a result, > the refcnt could go back to 1 from 0, which leads to a double > list_del()... Just replace refcount_inc() with >

[Patch net] ipt_CLUSTERIP: fix a refcount bug in clusterip_config_find_get()

In clusterip_config_find_get() we hold RCU read lock so it could run concurrently with clusterip_config_entry_put(), as a result, the refcnt could go back to 1 from 0, which leads to a double list_del()... Just replace refcount_inc() with refcount_inc_not_zero(), as for c->refcount. Fixes: