Re: [PATCH v2 nf] netfilter: nf_tables: fix memory leak during stateful obj update

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote:
> On Sun, Feb 20, 2022 at 12:18:50PM +0100, Florian Westphal wrote:
> > stateful objects can be updated from the control plane.
> > The transaction logic allocates a temporary object for this purpose.
> > 
> > This object has to be released via nft_obj_destroy, not kfree, since
> > the ->init function was called and it can have side effects beyond
> > memory allocation.
> > 
> > Unlike normal NEWOBJ path, the objects module refcount isn't
> > incremented, so add nft_newobj_destroy and use that.
> 
> Probably this? .udata and .key is NULL for the update path so kfree
> should be fine.

Yes, that works too.

We could also ...

> -	module_put(obj->ops->type->owner);
> +	/* nf_tables_updobj does not increment module refcount */
> +	if (!update)
> +		module_put(obj->ops->type->owner);
> +

Increment the refcount for update case as well to avoid the special
case?



[Index of Archives]     [Netfitler Users]     [Berkeley Packet Filter]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux