Patch "netfilter: x_tables: fix percpu counter block leak on error path when creating new netns" has been added to the 6.2-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    netfilter: x_tables: fix percpu counter block leak on error path when creating new netns

to the 6.2-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     netfilter-x_tables-fix-percpu-counter-block-leak-on-.patch
and it can be found in the queue-6.2 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 9cc19dcab40dbbb7a0dc9934d9a3b2ad9c14e6c8
Author: Pavel Tikhomirov <ptikhomirov@xxxxxxxxxxxxx>
Date:   Mon Feb 13 12:25:05 2023 +0800

    netfilter: x_tables: fix percpu counter block leak on error path when creating new netns
    
    [ Upstream commit 0af8c09c896810879387decfba8c942994bb61f5 ]
    
    Here is the stack where we allocate percpu counter block:
    
      +-< __alloc_percpu
        +-< xt_percpu_counter_alloc
          +-< find_check_entry # {arp,ip,ip6}_tables.c
            +-< translate_table
    
    And it can be leaked on this code path:
    
      +-> ip6t_register_table
        +-> translate_table # allocates percpu counter block
        +-> xt_register_table # fails
    
    there is no freeing of the counter block on xt_register_table fail.
    Note: xt_percpu_counter_free should be called to free it like we do in
    do_replace through cleanup_entry helper (or in __ip6t_unregister_table).
    
    Probability of hitting this error path is low AFAICS (xt_register_table
    can only return ENOMEM here, as it is not replacing anything, as we are
    creating new netns, and it is hard to imagine that all previous
    allocations succeeded and after that one in xt_register_table failed).
    But it's worth fixing even the rare leak.
    
    Fixes: 71ae0dff02d7 ("netfilter: xtables: use percpu rule counters")
    Signed-off-by: Pavel Tikhomirov <ptikhomirov@xxxxxxxxxxxxx>
    Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index ffc0cab7cf189..2407066b0fec1 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -1525,6 +1525,10 @@ int arpt_register_table(struct net *net,
 
 	new_table = xt_register_table(net, table, &bootstrap, newinfo);
 	if (IS_ERR(new_table)) {
+		struct arpt_entry *iter;
+
+		xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
+			cleanup_entry(iter, net);
 		xt_free_table_info(newinfo);
 		return PTR_ERR(new_table);
 	}
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index aae5fd51dfd74..da5998011ab9b 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -1741,6 +1741,10 @@ int ipt_register_table(struct net *net, const struct xt_table *table,
 
 	new_table = xt_register_table(net, table, &bootstrap, newinfo);
 	if (IS_ERR(new_table)) {
+		struct ipt_entry *iter;
+
+		xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
+			cleanup_entry(iter, net);
 		xt_free_table_info(newinfo);
 		return PTR_ERR(new_table);
 	}
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index ac902f7bca477..0ce0ed17c7583 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -1750,6 +1750,10 @@ int ip6t_register_table(struct net *net, const struct xt_table *table,
 
 	new_table = xt_register_table(net, table, &bootstrap, newinfo);
 	if (IS_ERR(new_table)) {
+		struct ip6t_entry *iter;
+
+		xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
+			cleanup_entry(iter, net);
 		xt_free_table_info(newinfo);
 		return PTR_ERR(new_table);
 	}