From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Tue, 9 Aug 2022 15:23:52 +0000 (+0200)
Subject: netfilter: nf_tables: possible module reference underflow in error path
X-Git-Tag: v6.0-rc2~26^2~12^2~14
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=c485c35ff6783ccd12c160fcac6a0e504e83e0bf;p=thirdparty%2Flinux.git

netfilter: nf_tables: possible module reference underflow in error path

dst->ops is set on when nft_expr_clone() fails, but module refcount has
not been bumped yet, therefore nft_expr_destroy() leads to module
reference underflow.

Fixes: 8cfd9b0f8515 ("netfilter: nftables: generalize set expressions support")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index ac549c5b88c2d..989c9782ecc34 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -5601,7 +5601,7 @@ int nft_set_elem_expr_clone(const struct nft_ctx *ctx, struct nft_set *set,
 
 		err = nft_expr_clone(expr, set->exprs[i]);
 		if (err < 0) {
-			nft_expr_destroy(ctx, expr);
+			kfree(expr);
 			goto err_expr;
 		}
 		expr_array[i] = expr;