Commit a02f4248 authored Jun 11, 2016 by Liping Zhang Committed by Pablo Neira Ayuso Jun 15, 2016

netfilter: nf_tables: fix wrong destroy anonymous sets if binding fails



When we add a nft rule like follows:
  # nft add rule filter test tcp dport vmap {1: jump test}
-ELOOP error will be returned, and the anonymous set will be
destroyed.

But after that, nf_tables_abort will also try to remove the
element and destroy the set, which was already destroyed and
freed.

If we add a nft wrong rule, nft_tables_abort will do the cleanup
work rightly, so nf_tables_set_destroy call here is redundant and
wrong, remove it.

Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

parent 8588ac09

net/netfilter/nf_tables_api.c

+1 −6

Original line number	Diff line number	Diff line
		@@ -2958,14 +2958,9 @@ int nf_tables_bind_set(const struct nft_ctx ctx, struct nft_set set,
		iter.fn = nf_tables_bind_check_setelem;

		set->ops->walk(ctx, set, &iter);
		if (iter.err < 0) {
		/* Destroy anonymous sets if binding fails */
		if (set->flags & NFT_SET_ANONYMOUS)
		nf_tables_set_destroy(ctx, set);

		if (iter.err < 0)
		return iter.err;
		}
		}
		bind:
		binding->chain = ctx->chain;
		list_add_tail_rcu(&binding->list, &set->bindings);