Since ed0a0c60f0e5 ("netfilter: nft_quota: move stateful fields out of
expression data"), stateful expressions allocate stateful area via
kmalloc().
Call ->ops->destroy() to release expression stateful information before
releasing the expression.
->ops->deactivate() is also called for safety reasons, no stateful
expressions support for this function.
Fixes: 6cafaf4764a3 ("netfilter: nf_tables: fix memory leak if expr init fails")
Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
---
net/netfilter/nf_tables_api.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 5ee4e7b28b61..017b77067852 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -2904,6 +2904,11 @@ static struct nft_expr *nft_expr_init(const struct nft_ctx *ctx,
return expr;
err_expr_new:
+ if (expr->ops->deactivate)
+ expr->ops->deactivate(ctx, expr, NFT_TRANS_RELEASE);
+ if (expr_info.ops->destroy)
+ expr_info.ops->destroy(ctx, expr);
+
kfree(expr);
err_expr_stateful:
owner = expr_info.ops->type->owner;
--
2.30.2
