diff options
| author | Liping Zhang <zlpnobody@gmail.com> | 2016-10-22 18:51:25 +0800 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2016-10-27 18:20:45 +0200 |
| commit | 61f9e2924f4981d626b3a931fed935f2fa3cb4de (patch) | |
| tree | 77d9f1c293690b43f9d858294e3164b464edd5fa /net/netfilter/nft_set_rbtree.c | |
| parent | bb6a6e8e091353770074608c1d1bfde0e20b8154 (diff) | |
| download | op-kernel-dev-61f9e2924f4981d626b3a931fed935f2fa3cb4de.zip op-kernel-dev-61f9e2924f4981d626b3a931fed935f2fa3cb4de.tar.gz | |
netfilter: nf_tables: fix *leak* when expr clone fail
When nft_expr_clone failed, a series of problems will happen:
1. module refcnt will leak, we call __module_get at the beginning but
we forget to put it back if ops->clone returns fail
2. memory will be leaked, if clone fail, we just return NULL and forget
to free the alloced element
3. set->nelems will become incorrect when set->size is specified. If
clone fail, we should decrease the set->nelems
Now this patch fixes these problems. And fortunately, clone fail will
only happen on counter expression when memory is exhausted.
Fixes: 086f332167d6 ("netfilter: nf_tables: add clone interface to expression operations")
Signed-off-by: Liping Zhang <zlpnobody@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/netfilter/nft_set_rbtree.c')
| -rw-r--r-- | net/netfilter/nft_set_rbtree.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c index 38b5bda..36493a7 100644 --- a/net/netfilter/nft_set_rbtree.c +++ b/net/netfilter/nft_set_rbtree.c @@ -266,7 +266,7 @@ static void nft_rbtree_destroy(const struct nft_set *set) while ((node = priv->root.rb_node) != NULL) { rb_erase(node, &priv->root); rbe = rb_entry(node, struct nft_rbtree_elem, node); - nft_set_elem_destroy(set, rbe); + nft_set_elem_destroy(set, rbe, true); } } |
