Commit f0dfd7a2 authored May 09, 2018 by Colin Ian King Committed by Pablo Neira Ayuso May 14, 2018

netfilter: nf_tables: fix memory leak on error exit return



Currently the -EBUSY error return path is not free'ing resources
allocated earlier, leaving a memory leak. Fix this by exiting via the
error exit label err5 that performs the necessary resource clean
up.

Detected by CoverityScan, CID#1432975 ("Resource leak")

Fixes: 9744a6fc ("netfilter: nf_tables: check if same extensions are set when adding elements")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

parent bb7b40ae

net/netfilter/nf_tables_api.c

+4 −2

Original line number	Diff line number	Diff line
		@@ -4080,8 +4080,10 @@ static int nft_add_set_elem(struct nft_ctx ctx, struct nft_set set,
		if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) ^
		nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) \|\|
		nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) ^
		nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF))
		return -EBUSY;
		nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF)) {
		err = -EBUSY;
		goto err5;
		}
		if ((nft_set_ext_exists(ext, NFT_SET_EXT_DATA) &&
		nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) &&
		memcmp(nft_set_ext_data(ext),