evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

netfilter: nf_tables: uninitialize element key/data from the commit path

Browse source 
This should happen once the element has been effectively released in
the commit path, not before. This fixes a possible chain refcount leak
if the transaction is aborted.

Reported-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Pablo Neira Ayuso 2014-08-01 19:32:41 +02:00
parent 33caee3992
commit a3716e70e1
1 changed files with 11 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
net/netfilter/nf_tables_api.c
View file

@ -3139,11 +3139,6 @@ static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set,
nft_trans_elem(trans) = elem; nft_trans_elem(trans) = elem;
list_add_tail(&trans->list, &ctx->net->nft.commit_list); list_add_tail(&trans->list, &ctx->net->nft.commit_list);
nft_data_uninit(&elem.key, NFT_DATA_VALUE);
if (set->flags & NFT_SET_MAP)
nft_data_uninit(&elem.data, set->dtype);
return 0; return 0;
err2: err2:
nft_data_uninit(&elem.key, desc.type); nft_data_uninit(&elem.key, desc.type);
@ -3310,7 +3305,7 @@ static int nf_tables_commit(struct sk_buff *skb)
{ {
struct net *net = sock_net(skb->sk); struct net *net = sock_net(skb->sk);
struct nft_trans *trans, *next; struct nft_trans *trans, *next;
struct nft_set *set; struct nft_trans_elem *te;
/* Bump generation counter, invalidate any dump in progress */ /* Bump generation counter, invalidate any dump in progress */
while (++net->nft.base_seq == 0); while (++net->nft.base_seq == 0);
@ -3396,13 +3391,17 @@ static int nf_tables_commit(struct sk_buff *skb)
nft_trans_destroy(trans); nft_trans_destroy(trans);
break; break;
case NFT_MSG_DELSETELEM: case NFT_MSG_DELSETELEM:
nf_tables_setelem_notify(&trans->ctx, te = (struct nft_trans_elem *)trans->data;
nft_trans_elem_set(trans), nf_tables_setelem_notify(&trans->ctx, te->set,
&nft_trans_elem(trans), &te->elem,
NFT_MSG_DELSETELEM, 0); NFT_MSG_DELSETELEM, 0);
set = nft_trans_elem_set(trans); te->set->ops->get(te->set, &te->elem);
set->ops->get(set, &nft_trans_elem(trans)); te->set->ops->remove(te->set, &te->elem);
set->ops->remove(set, &nft_trans_elem(trans)); nft_data_uninit(&te->elem.key, NFT_DATA_VALUE);
if (te->elem.flags & NFT_SET_MAP) {
nft_data_uninit(&te->elem.data,
te->set->dtype);
}
nft_trans_destroy(trans); nft_trans_destroy(trans);
break; break;
} }