From 95a917c1d7f83b89995651cd753008c20bed3302 Mon Sep 17 00:00:00 2001 From: =?utf8?q?Micha=C5=82=20Miros=C5=82aw?= Date: Sat, 24 Mar 2007 21:36:24 +0100 Subject: [PATCH] [NETFILTER]: nfnetlink_log: fix use after free MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit Paranoia: instance_put() might have freed the inst pointer when we spin_unlock_bh(). Signed-off-by: Michał Mirosław Signed-off-by: Patrick McHardy Signed-off-by: Adrian Bunk --- net/netfilter/nfnetlink_log.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c index c0a3ca64b9c9..d952e646ad5a 100644 --- a/net/netfilter/nfnetlink_log.c +++ b/net/netfilter/nfnetlink_log.c @@ -380,8 +380,8 @@ static void nfulnl_timer(unsigned long data) if (timer_pending(&inst->timer)) /* is it always true or false here? */ del_timer(&inst->timer); __nfulnl_send(inst); - instance_put(inst); spin_unlock_bh(&inst->lock); + instance_put(inst); } static inline int -- 2.47.3