Patch "netfilter: ebtables: fix memory leak when blob is malformed" has been added to the 5.10-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    netfilter: ebtables: fix memory leak when blob is malformed

to the 5.10-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     netfilter-ebtables-fix-memory-leak-when-blob-is-malf.patch
and it can be found in the queue-5.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 766539ae2e06fb1436312b6b4cd619ca429a705a
Author: Florian Westphal <fw@xxxxxxxxx>
Date:   Tue Sep 20 14:20:17 2022 +0200

    netfilter: ebtables: fix memory leak when blob is malformed
    
    [ Upstream commit 62ce44c4fff947eebdf10bb582267e686e6835c9 ]
    
    The bug fix was incomplete, it "replaced" crash with a memory leak.
    The old code had an assignment to "ret" embedded into the conditional,
    restore this.
    
    Fixes: 7997eff82828 ("netfilter: ebtables: reject blobs that don't provide all entry points")
    Reported-and-tested-by: syzbot+a24c5252f3e3ab733464@xxxxxxxxxxxxxxxxxxxxxxxxx
    Signed-off-by: Florian Westphal <fw@xxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 310740cc684a..06b80b584381 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -999,8 +999,10 @@ static int do_replace_finish(struct net *net, struct ebt_replace *repl,
 		goto free_iterate;
 	}
 
-	if (repl->valid_hooks != t->valid_hooks)
+	if (repl->valid_hooks != t->valid_hooks) {
+		ret = -EINVAL;
 		goto free_unlock;
+	}
 
 	if (repl->num_counters && repl->num_counters != t->private->nentries) {
 		ret = -EINVAL;