This is a note to let you know that I've just added the patch titled net/sched: act_ct: remove and free nf_table callbacks to the 5.10-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: net-sched-act_ct-remove-and-free-nf_table-callbacks.patch and it can be found in the queue-5.10 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 77ac5e40c44eb78333fbc38482d61fc2af7dda0a Mon Sep 17 00:00:00 2001 From: Louis Peens <louis.peens@xxxxxxxxxxxx> Date: Fri, 2 Jul 2021 11:21:38 +0200 Subject: net/sched: act_ct: remove and free nf_table callbacks From: Louis Peens <louis.peens@xxxxxxxxxxxx> commit 77ac5e40c44eb78333fbc38482d61fc2af7dda0a upstream. When cleaning up the nf_table in tcf_ct_flow_table_cleanup_work there is no guarantee that the callback list, added to by nf_flow_table_offload_add_cb, is empty. This means that it is possible that the flow_block_cb memory allocated will be lost. Fix this by iterating the list and freeing the flow_block_cb entries before freeing the nf_table entry (via freeing ct_ft). Fixes: 978703f42549 ("netfilter: flowtable: Add API for registering to flow table events") Signed-off-by: Louis Peens <louis.peens@xxxxxxxxxxxx> Signed-off-by: Yinjun Zhang <yinjun.zhang@xxxxxxxxxxxx> Signed-off-by: Simon Horman <simon.horman@xxxxxxxxxxxx> Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- net/sched/act_ct.c | 11 +++++++++++ 1 file changed, 11 insertions(+) --- a/net/sched/act_ct.c +++ b/net/sched/act_ct.c @@ -320,11 +320,22 @@ err_alloc: static void tcf_ct_flow_table_cleanup_work(struct work_struct *work) { + struct flow_block_cb *block_cb, *tmp_cb; struct tcf_ct_flow_table *ct_ft; + struct flow_block *block; ct_ft = container_of(to_rcu_work(work), struct tcf_ct_flow_table, rwork); nf_flow_table_free(&ct_ft->nf_ft); + + /* Remove any remaining callbacks before cleanup */ + block = &ct_ft->nf_ft.flow_block; + down_write(&ct_ft->nf_ft.flow_block_lock); + list_for_each_entry_safe(block_cb, tmp_cb, &block->cb_list, list) { + list_del(&block_cb->list); + flow_block_cb_free(block_cb); + } + up_write(&ct_ft->nf_ft.flow_block_lock); kfree(ct_ft); module_put(THIS_MODULE); Patches currently in stable-queue which might be from louis.peens@xxxxxxxxxxxx are queue-5.10/net-sched-act_ct-remove-and-free-nf_table-callbacks.patch