diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2022-08-09 17:23:52 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2022-08-10 17:06:05 +0200 |
| commit | c485c35ff6783ccd12c160fcac6a0e504e83e0bf (patch) | |
| tree | 45fa7249eea21ad991362492888fb28a3548c775 /net | |
| parent | 4963674c2e71fc062f8f089f0f58ffbb5533060b (diff) | |
| download | linux-stable-c485c35ff6783ccd12c160fcac6a0e504e83e0bf.tar.gz linux-stable-c485c35ff6783ccd12c160fcac6a0e504e83e0bf.tar.bz2 linux-stable-c485c35ff6783ccd12c160fcac6a0e504e83e0bf.zip | |
netfilter: nf_tables: possible module reference underflow in error path
dst->ops is set on when nft_expr_clone() fails, but module refcount has
not been bumped yet, therefore nft_expr_destroy() leads to module
reference underflow.
Fixes: 8cfd9b0f8515 ("netfilter: nftables: generalize set expressions support")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/netfilter/nf_tables_api.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index ac549c5b88c2..989c9782ecc3 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -5601,7 +5601,7 @@ int nft_set_elem_expr_clone(const struct nft_ctx *ctx, struct nft_set *set, err = nft_expr_clone(expr, set->exprs[i]); if (err < 0) { - nft_expr_destroy(ctx, expr); + kfree(expr); goto err_expr; } expr_array[i] = expr; |