From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Thu, 13 Jan 2022 11:22:38 +0000 (+0100)
Subject: netfilter: nft_connlimit: memleak if nf_ct_netns_get() fails
X-Git-Tag: v5.15.148~7
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=e562d8422555b8040091d0369a209e021733a4f5;p=thirdparty%2Fkernel%2Fstable.git

netfilter: nft_connlimit: memleak if nf_ct_netns_get() fails

commit 7d70984a1ad4c445dff08edb9aacce8906b6a222 upstream.

Check if nf_ct_netns_get() fails then release the limit object
previously allocated via kmalloc().

Fixes: 37f319f37d90 ("netfilter: nft_connlimit: move stateful fields out of expression data")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---

diff --git a/net/netfilter/nft_connlimit.c b/net/netfilter/nft_connlimit.c
index 8f0cba15eb21e..f5df535bcbd08 100644
--- a/net/netfilter/nft_connlimit.c
+++ b/net/netfilter/nft_connlimit.c
@@ -62,6 +62,7 @@ static int nft_connlimit_do_init(const struct nft_ctx *ctx,
 {
 	bool invert = false;
 	u32 flags, limit;
+	int err;
 
 	if (!tb[NFTA_CONNLIMIT_COUNT])
 		return -EINVAL;
@@ -84,7 +85,15 @@ static int nft_connlimit_do_init(const struct nft_ctx *ctx,
 	priv->limit	= limit;
 	priv->invert	= invert;
 
-	return nf_ct_netns_get(ctx->net, ctx->family);
+	err = nf_ct_netns_get(ctx->net, ctx->family);
+	if (err < 0)
+		goto err_netns;
+
+	return 0;
+err_netns:
+	kfree(priv->list);
+
+	return err;
 }
 
 static void nft_connlimit_do_destroy(const struct nft_ctx *ctx,