Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 74fd5839 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso Committed by Greg Kroah-Hartman
Browse files

netfilter: nf_tables: release flow rule object from commit path 



[ Upstream commit 26b5934ff4194e13196bedcba373cd4915071d0e ]

No need to postpone this to the commit release path, since no packets
are walking over this object, this is accessed from control plane only.
This helped uncovered UAF triggered by races with the netlink notifier.

Fixes: 9dd732e0bdf5 ("netfilter: nf_tables: memleak flow rule from commit path")
Reported-by: default avatar <syzbot+8f747f62763bc6c32916@syzkaller.appspotmail.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent ca791952

net/netfilter/nf_tables_api.c

+3 −3
Original line number Original line Diff line number Diff line
@@ -6576,9 +6576,6 @@ static void nft_commit_release(struct nft_trans *trans) 
		nf_tables_chain_destroy(&trans->ctx);

		nf_tables_chain_destroy(&trans->ctx);

		break;

		break;

	case NFT_MSG_DELRULE:

	case NFT_MSG_DELRULE:

		if (trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD)

			nft_flow_rule_destroy(nft_trans_flow_rule(trans));



		nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));

		nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));

		break;

		break;

	case NFT_MSG_DELSET:

	case NFT_MSG_DELSET:
@@ -6913,6 +6910,9 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) 
			nft_rule_expr_deactivate(&trans->ctx,

			nft_rule_expr_deactivate(&trans->ctx,

						 nft_trans_rule(trans),

						 nft_trans_rule(trans),

						 NFT_TRANS_COMMIT);

						 NFT_TRANS_COMMIT);



			if (trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD)

				nft_flow_rule_destroy(nft_trans_flow_rule(trans));

			break;

			break;

		case NFT_MSG_NEWSET:

		case NFT_MSG_NEWSET:

			nft_clear(net, nft_trans_set(trans));

			nft_clear(net, nft_trans_set(trans));