From: Cong Wang <>
Date: Tue, 11 Oct 2016 10:56:45 -0700

> Krister reported a kernel NULL pointer dereference after
> tcf_action_init_1() invokes a_o->init(), it is a race condition
> where one thread calling tcf_register_action() to initialize
> the netns data after putting act ops in the global list and
> the other thread searching the list and then calling
> a_o->init(net, ...).
> Fix this by moving the pernet ops registration before making
> the action ops visible. This is fine because: a) we don't
> rely on act_base in pernet ops->init(), b) in the worst case we
> have a fully initialized netns but ops is still not ready so
> new actions still can't be created.
> Reported-by: Krister Johansen <>
> Tested-by: Krister Johansen <>
> Cc: Jamal Hadi Salim <>
> Signed-off-by: Cong Wang <>

Applied and queued up for -stable, thanks.

Reply via email to