Patch "netfilter: x_tables: fix percpu counter block leak on error path when creating new netns" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    netfilter: x_tables: fix percpu counter block leak on error path when creating new netns

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     netfilter-x_tables-fix-percpu-counter-block-leak-on-.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 3e4464ffe9e7a976bbccaf2fa0c6474830c3dca6
Author: Pavel Tikhomirov <ptikhomirov@xxxxxxxxxxxxx>
Date:   Mon Feb 13 12:25:05 2023 +0800

    netfilter: x_tables: fix percpu counter block leak on error path when creating new netns
    
    [ Upstream commit 0af8c09c896810879387decfba8c942994bb61f5 ]
    
    Here is the stack where we allocate percpu counter block:
    
      +-< __alloc_percpu
        +-< xt_percpu_counter_alloc
          +-< find_check_entry # {arp,ip,ip6}_tables.c
            +-< translate_table
    
    And it can be leaked on this code path:
    
      +-> ip6t_register_table
        +-> translate_table # allocates percpu counter block
        +-> xt_register_table # fails
    
    there is no freeing of the counter block on xt_register_table fail.
    Note: xt_percpu_counter_free should be called to free it like we do in
    do_replace through cleanup_entry helper (or in __ip6t_unregister_table).
    
    Probability of hitting this error path is low AFAICS (xt_register_table
    can only return ENOMEM here, as it is not replacing anything, as we are
    creating new netns, and it is hard to imagine that all previous
    allocations succeeded and after that one in xt_register_table failed).
    But it's worth fixing even the rare leak.
    
    Fixes: 71ae0dff02d7 ("netfilter: xtables: use percpu rule counters")
    Signed-off-by: Pavel Tikhomirov <ptikhomirov@xxxxxxxxxxxxx>
    Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index c53f14b943560..71bf3aeed73c1 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -1524,6 +1524,10 @@ int arpt_register_table(struct net *net,
 
 	new_table = xt_register_table(net, table, &bootstrap, newinfo);
 	if (IS_ERR(new_table)) {
+		struct arpt_entry *iter;
+
+		xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
+			cleanup_entry(iter, net);
 		xt_free_table_info(newinfo);
 		return PTR_ERR(new_table);
 	}
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 91301dc3924a2..a748a1e754605 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -1740,6 +1740,10 @@ int ipt_register_table(struct net *net, const struct xt_table *table,
 
 	new_table = xt_register_table(net, table, &bootstrap, newinfo);
 	if (IS_ERR(new_table)) {
+		struct ipt_entry *iter;
+
+		xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
+			cleanup_entry(iter, net);
 		xt_free_table_info(newinfo);
 		return PTR_ERR(new_table);
 	}
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 7ba68388d2e1f..277a5ee887eb3 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -1750,6 +1750,10 @@ int ip6t_register_table(struct net *net, const struct xt_table *table,
 
 	new_table = xt_register_table(net, table, &bootstrap, newinfo);
 	if (IS_ERR(new_table)) {
+		struct ip6t_entry *iter;
+
+		xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
+			cleanup_entry(iter, net);
 		xt_free_table_info(newinfo);
 		return PTR_ERR(new_table);
 	}