netfilter: nft_socket: fix sk refcount leaks

[ Upstream commit 8b26ff7af8c32cb4148b3e147c52f9e4c695209c ]

We must put 'sk' reference before returning.

Fixes: 039b1f4f24ec ("netfilter: nft_socket: fix erroneous socket assignment")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/net/netfilter/nft_socket.c b/net/netfilter/nft_socket.c
index 3c444fcb20ec04c1e8000642c9e6a69629f56243..3cbfb6ba32c7cf441c88cc9c6423f1c8f6df26ff 100644 (file)
--- a/net/netfilter/nft_socket.c
+++ b/net/netfilter/nft_socket.c
@@ -108,13 +108,13 @@ static void nft_socket_eval(const struct nft_expr *expr,
                        *dest = sk->sk_mark;
                } else {
                        regs->verdict.code = NFT_BREAK;
-                       return;
+                       goto out_put_sk;
                }
                break;
        case NFT_SOCKET_WILDCARD:
                if (!sk_fullsock(sk)) {
                        regs->verdict.code = NFT_BREAK;
-                       return;
+                       goto out_put_sk;
                }
                nft_socket_wildcard(pkt, regs, sk, dest);
                break;
@@ -122,7 +122,7 @@ static void nft_socket_eval(const struct nft_expr *expr,
        case NFT_SOCKET_CGROUPV2:
                if (!nft_sock_get_eval_cgroupv2(dest, sk, pkt, priv->level)) {
                        regs->verdict.code = NFT_BREAK;
-                       return;
+                       goto out_put_sk;
                }
                break;
 #endif
@@ -131,6 +131,7 @@ static void nft_socket_eval(const struct nft_expr *expr,
                regs->verdict.code = NFT_BREAK;
        }
 
+out_put_sk:
        if (sk != skb->sk)
                sock_gen_put(sk);
 }