]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
netfilter: nf_tables: fix memory leak in nf_tables_newrule()
authorZilin Guan <zilin@seu.edu.cn>
Wed, 24 Dec 2025 12:48:26 +0000 (12:48 +0000)
committerFlorian Westphal <fw@strlen.de>
Fri, 2 Jan 2026 09:44:28 +0000 (10:44 +0100)
commitd077e8119ddbb4fca67540f1a52453631a47f221
treed0d5a18deeec3ee2bf083fc747f84745c668be65
parent2bafeb8d2f380c3a81d98bd7b78b854b564f9cd4
netfilter: nf_tables: fix memory leak in nf_tables_newrule()

In nf_tables_newrule(), if nft_use_inc() fails, the function jumps to
the err_release_rule label without freeing the allocated flow, leading
to a memory leak.

Fix this by adding a new label err_destroy_flow and jumping to it when
nft_use_inc() fails. This ensures that the flow is properly released
in this error case.

Fixes: 1689f25924ada ("netfilter: nf_tables: report use refcount overflow")
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
Signed-off-by: Florian Westphal <fw@strlen.de>
net/netfilter/nf_tables_api.c