Commit 6cafaf47 authored Jun 20, 2016 by Liping Zhang Committed by Pablo Neira Ayuso Jun 23, 2016

netfilter: nf_tables: fix memory leak if expr init fails



If expr init fails then we need to free it.

So when the user add a nft rule as follows:

  # nft add rule filter input tcp dport 22 flow table ssh \
    { ip saddr limit rate 0/second }

memory leak will happen.

Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

parent acd43fe8

net/netfilter/nf_tables_api.c

+3 −1

Original line number	Diff line number	Diff line
		@@ -1724,9 +1724,11 @@ struct nft_expr nft_expr_init(const struct nft_ctx ctx,

		err = nf_tables_newexpr(ctx, &info, expr);
		if (err < 0)
		goto err2;
		goto err3;

		return expr;
		err3:
		kfree(expr);
		err2:
		module_put(info.ops->type->owner);
		err1: