Commit d96fc659 authored Apr 03, 2012 by Pablo Neira Ayuso Committed by David S. Miller Apr 03, 2012

netfilter: nf_conntrack: fix count leak in error path of __nf_conntrack_alloc



We have to decrement the conntrack counter if we fail to access the
zone extension.

Reported-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent ee14186f

net/netfilter/nf_conntrack_core.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -735,6 +735,7 @@ __nf_conntrack_alloc(struct net *net, u16 zone,

		#ifdef CONFIG_NF_CONNTRACK_ZONES
		out_free:
		atomic_dec(&net->ct.count);
		kmem_cache_free(net->ct.nf_conntrack_cachep, ct);
		return ERR_PTR(-ENOMEM);
		#endif