mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-25 02:09:42 +00:00
netfilter: nf_tables: release flow rule object from commit path
[ Upstream commit26b5934ff4
] No need to postpone this to the commit release path, since no packets are walking over this object, this is accessed from control plane only. This helped uncovered UAF triggered by races with the netlink notifier. Fixes:9dd732e0bd
("netfilter: nf_tables: memleak flow rule from commit path") Reported-by: syzbot+8f747f62763bc6c32916@syzkaller.appspotmail.com Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
ca791952d4
commit
74fd583946
1 changed files with 3 additions and 3 deletions
|
@ -6576,9 +6576,6 @@ static void nft_commit_release(struct nft_trans *trans)
|
||||||
nf_tables_chain_destroy(&trans->ctx);
|
nf_tables_chain_destroy(&trans->ctx);
|
||||||
break;
|
break;
|
||||||
case NFT_MSG_DELRULE:
|
case NFT_MSG_DELRULE:
|
||||||
if (trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD)
|
|
||||||
nft_flow_rule_destroy(nft_trans_flow_rule(trans));
|
|
||||||
|
|
||||||
nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
|
nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
|
||||||
break;
|
break;
|
||||||
case NFT_MSG_DELSET:
|
case NFT_MSG_DELSET:
|
||||||
|
@ -6913,6 +6910,9 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)
|
||||||
nft_rule_expr_deactivate(&trans->ctx,
|
nft_rule_expr_deactivate(&trans->ctx,
|
||||||
nft_trans_rule(trans),
|
nft_trans_rule(trans),
|
||||||
NFT_TRANS_COMMIT);
|
NFT_TRANS_COMMIT);
|
||||||
|
|
||||||
|
if (trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD)
|
||||||
|
nft_flow_rule_destroy(nft_trans_flow_rule(trans));
|
||||||
break;
|
break;
|
||||||
case NFT_MSG_NEWSET:
|
case NFT_MSG_NEWSET:
|
||||||
nft_clear(net, nft_trans_set(trans));
|
nft_clear(net, nft_trans_set(trans));
|
||||||
|
|
Loading…
Reference in a new issue