lkml.org 
[lkml]   [2019]   [May]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 071/113] netfilter: nf_tables: add missing ->release_ops() in error path of newrule()
    Date
    [ Upstream commit b25a31bf0ca091aa8bdb9ab329b0226257568bbe ]

    ->release_ops() callback releases resources and this is used in error path.
    If nf_tables_newrule() fails after ->select_ops(), it should release
    resources. but it can not call ->destroy() because that should be called
    after ->init().
    At this point, ->release_ops() should be used for releasing resources.

    Test commands:
    modprobe -rv xt_tcpudp
    iptables-nft -I INPUT -m tcp <-- error command
    lsmod

    Result:
    Module Size Used by
    xt_tcpudp 20480 2 <-- it should be 0

    Fixes: b8e204006340 ("netfilter: nft_compat: use .release_ops and remove list of extension")
    Signed-off-by: Taehee Yoo <ap420073@gmail.com>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    ---
    net/netfilter/nf_tables_api.c | 5 ++++-
    1 file changed, 4 insertions(+), 1 deletion(-)

    diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
    index ef7ff13a7b992..ebfcfe1dcbdbb 100644
    --- a/net/netfilter/nf_tables_api.c
    +++ b/net/netfilter/nf_tables_api.c
    @@ -2719,8 +2719,11 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk,
    nf_tables_rule_release(&ctx, rule);
    err1:
    for (i = 0; i < n; i++) {
    - if (info[i].ops != NULL)
    + if (info[i].ops) {
    module_put(info[i].ops->type->owner);
    + if (info[i].ops->type->release_ops)
    + info[i].ops->type->release_ops(info[i].ops);
    + }
    }
    kvfree(info);
    return err;
    --
    2.20.1


    \
     
     \ /
      Last update: 2019-05-15 13:48    [W:4.092 / U:0.836 seconds]
    ©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site