• Taehee Yoo's avatar
    netfilter: nf_tables: fix leaking object reference count · 4c541a5a
    Taehee Yoo authored
    [ Upstream commit b91d9036 ]
    
    There is no code that decreases the reference count of stateful objects
    in error path of the nft_add_set_elem(). this causes a leak of reference
    count of stateful objects.
    
    Test commands:
       $nft add table ip filter
       $nft add counter ip filter c1
       $nft add map ip filter m1 { type ipv4_addr : counter \;}
       $nft add element ip filter m1 { 1 : c1 }
       $nft add element ip filter m1 { 1 : c1 }
       $nft delete element ip filter m1 { 1 }
       $nft delete counter ip filter c1
    
    Result:
       Error: Could not process rule: Device or resource busy
       delete counter ip filter c1
       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    
    At the second 'nft add element ip filter m1 { 1 : c1 }', the reference
    count of the 'c1' is increased then it tries to insert into the 'm1'. but
    the 'm1' already has same element so it returns -EEXIST.
    But it doesn't decrease the reference count of the 'c1' in the error path.
    Due to a leak of the reference count of the 'c1', the 'c1' can't be
    removed by 'nft delete counter ip filter c1'.
    
    Fixes: 8aeff920
    
     ("netfilter: nf_tables: add stateful object reference to set elements")
    Signed-off-by: default avatarTaehee Yoo <ap420073@gmail.com>
    Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
    4c541a5a
nf_tables_api.c 143 KB