From: Pablo Neira Ayuso Date: Wed, 14 Jun 2023 21:20:18 +0000 (+0200) Subject: netfilter: nf_tables: drop module reference after updating chain X-Git-Tag: v6.3.10~5 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=2a4d5af41e7ed043a93caf6f97d2d4c566a70531;p=thirdparty%2Fkernel%2Fstable.git netfilter: nf_tables: drop module reference after updating chain commit 043d2acf57227db1fdaaa620b2a420acfaa56d6e upstream. Otherwise the module reference counter is leaked. Fixes b9703ed44ffb ("netfilter: nf_tables: support for adding new devices to an existing netdev chain") Signed-off-by: Pablo Neira Ayuso Signed-off-by: Greg Kroah-Hartman --- diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index b9e276820c722..398bb8fb30a52 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -2664,6 +2664,8 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy, nft_trans_basechain(trans) = basechain; INIT_LIST_HEAD(&nft_trans_chain_hooks(trans)); list_splice(&hook.list, &nft_trans_chain_hooks(trans)); + if (nla[NFTA_CHAIN_HOOK]) + module_put(hook.type->owner); nft_trans_commit_list_add_tail(ctx->net, trans);