This is a note to let you know that I've just added the patch titled
netfilter: nft_connlimit: memleak if nf_ct_netns_get() fails
to the 5.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
netfilter-nft_connlimit-memleak-if-nf_ct_netns_get-fails.patch
and it can be found in the queue-5.15 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 7d70984a1ad4c445dff08edb9aacce8906b6a222 Mon Sep 17 00:00:00 2001
From: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
Date: Thu, 13 Jan 2022 12:22:38 +0100
Subject: netfilter: nft_connlimit: memleak if nf_ct_netns_get() fails
From: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
commit 7d70984a1ad4c445dff08edb9aacce8906b6a222 upstream.
Check if nf_ct_netns_get() fails then release the limit object
previously allocated via kmalloc().
Fixes: 37f319f37d90 ("netfilter: nft_connlimit: move stateful fields out of expression data")
Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
net/netfilter/nft_connlimit.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
--- a/net/netfilter/nft_connlimit.c
+++ b/net/netfilter/nft_connlimit.c
@@ -62,6 +62,7 @@ static int nft_connlimit_do_init(const s
{
bool invert = false;
u32 flags, limit;
+ int err;
if (!tb[NFTA_CONNLIMIT_COUNT])
return -EINVAL;
@@ -84,7 +85,15 @@ static int nft_connlimit_do_init(const s
priv->limit = limit;
priv->invert = invert;
- return nf_ct_netns_get(ctx->net, ctx->family);
+ err = nf_ct_netns_get(ctx->net, ctx->family);
+ if (err < 0)
+ goto err_netns;
+
+ return 0;
+err_netns:
+ kfree(priv->list);
+
+ return err;
}
static void nft_connlimit_do_destroy(const struct nft_ctx *ctx,
Patches currently in stable-queue which might be from pablo@xxxxxxxxxxxxx are
queue-5.15/netfilter-nf_tables-check-if-catch-all-set-element-is-active-in-next-generation.patch
queue-5.15/netfilter-nft_quota-move-stateful-fields-out-of-expr.patch
queue-5.15/ipvs-avoid-stat-macros-calls-from-preemptible-contex.patch
queue-5.15/netfilter-nf_tables-skip-dead-set-elements-in-netlin.patch
queue-5.15/netfilter-nft_last-copy-content-when-cloning-expression.patch
queue-5.15/netfilter-nft_limit-move-stateful-fields-out-of-expr.patch
queue-5.15/netfilter-nft_connlimit-memleak-if-nf_ct_netns_get-fails.patch
queue-5.15/netfilter-nft_connlimit-move-stateful-fields-out-of-.patch
queue-5.15/netfilter-nft_limit-fix-stateful-object-memory-leak.patch
queue-5.15/netfilter-nf_tables-memcg-accounting-for-dynamically.patch
queue-5.15/netfilter-nf_tables-reject-invalid-set-policy.patch
queue-5.15/netfilter-nf_tables-do-not-allow-mismatch-field-size.patch
queue-5.15/netfilter-nft_last-move-stateful-fields-out-of-expre.patch
queue-5.15/netfilter-nft_quota-copy-content-when-cloning-expression.patch
queue-5.15/netfilter-nft_limit-clone-packet-limits-cost-value.patch
queue-5.15/netfilter-nf_tables-mark-newset-as-dead-on-transacti.patch
queue-5.15/netfilter-nf_tables-typo-null-check-in-_clone-function.patch
queue-5.15/netfilter-nft_limit-rename-stateful-structure.patch
queue-5.15/netfilter-nf_tables-reject-nft_set_concat-with-not-f.patch
queue-5.15/netfilter-nft_limit-do-not-ignore-unsupported-flags.patch
