netfilter: nf_tables: fix leaking object reference count
There is no code that decreases the reference count of stateful objects
in error path of the nft_add_set_elem(). this causes a leak of reference
count of stateful objects.
Test commands:
$nft add table ip filter
$nft add counter ip filter c1
$nft add map ip filter m1 { type ipv4_addr : counter \;}
$nft add element ip filter m1 { 1 : c1 }
$nft add element ip filter m1 { 1 : c1 }
$nft delete element ip filter m1 { 1 }
$nft delete counter ip filter c1
Result:
Error: Could not process rule: Device or resource busy
delete counter ip filter c1
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
At the second 'nft add element ip filter m1 { 1 : c1 }', the reference
count of the 'c1' is increased then it tries to insert into the 'm1'. but
the 'm1' already has same element so it returns -EEXIST.
But it doesn't decrease the reference count of the 'c1' in the error path.
Due to a leak of the reference count of the 'c1', the 'c1' can't be
removed by 'nft delete counter ip filter c1'.
Fixes: 8aeff920dc
("netfilter: nf_tables: add stateful object reference to set elements")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Родитель
310529e663
Коммит
b91d903688
|
@ -4506,6 +4506,8 @@ err6:
|
||||||
err5:
|
err5:
|
||||||
kfree(trans);
|
kfree(trans);
|
||||||
err4:
|
err4:
|
||||||
|
if (obj)
|
||||||
|
obj->use--;
|
||||||
kfree(elem.priv);
|
kfree(elem.priv);
|
||||||
err3:
|
err3:
|
||||||
if (nla[NFTA_SET_ELEM_DATA] != NULL)
|
if (nla[NFTA_SET_ELEM_DATA] != NULL)
|
||||||
|
|
Загрузка…
Ссылка в новой задаче