netfilter: nft_socket: fix sk refcount leaks

commit 8b26ff7af8c32cb4148b3e147c52f9e4c695209c upstream.

We must put 'sk' reference before returning.

Fixes: 039b1f4f24ec ("netfilter: nft_socket: fix erroneous socket assignment")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/net/netfilter/nft_socket.c b/net/netfilter/nft_socket.c
index 826e5f8c78f34c9c20585727a0b431fcd8211901..07e73e50b713b64eacb9cd2b3e131b80a692ce23 100644 (file)
--- a/net/netfilter/nft_socket.c
+++ b/net/netfilter/nft_socket.c
@@ -88,13 +88,13 @@ static void nft_socket_eval(const struct nft_expr *expr,
                        *dest = sk->sk_mark;
                } else {
                        regs->verdict.code = NFT_BREAK;
-                       return;
+                       goto out_put_sk;
                }
                break;
        case NFT_SOCKET_WILDCARD:
                if (!sk_fullsock(sk)) {
                        regs->verdict.code = NFT_BREAK;
-                       return;
+                       goto out_put_sk;
                }
                nft_socket_wildcard(pkt, regs, sk, dest);
                break;
@@ -103,6 +103,7 @@ static void nft_socket_eval(const struct nft_expr *expr,
                regs->verdict.code = NFT_BREAK;
        }
 
+out_put_sk:
        if (sk != skb->sk)
                sock_gen_put(sk);
 }