mirror of
https://github.com/torvalds/linux
synced 2024-09-06 18:01:05 +00:00
netfilter: nf_nat: Fix possible memory leak in nf_nat_init()
In nf_nat_init(), register_nf_nat_bpf() can fail and return directly
without any error handling.
Then nf_nat_bysource will leak and registering of &nat_net_ops,
&follow_master_nat and nf_nat_hook won't be reverted.
This leaves wild ops in linkedlists and when another module tries to
call register_pernet_operations() or nf_ct_helper_expectfn_register()
it triggers page fault:
BUG: unable to handle page fault for address: fffffbfff81b964c
RIP: 0010:register_pernet_operations+0x1b9/0x5f0
Call Trace:
<TASK>
register_pernet_subsys+0x29/0x40
ebtables_init+0x58/0x1000 [ebtables]
...
Fixes: 820dc0523e
("net: netfilter: move bpf_ct_set_nat_info kfunc in nf_nat_bpf.c")
Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
parent
5663ed63ad
commit
cbc1dd5b65
|
@ -1152,7 +1152,16 @@ static int __init nf_nat_init(void)
|
|||
WARN_ON(nf_nat_hook != NULL);
|
||||
RCU_INIT_POINTER(nf_nat_hook, &nat_hook);
|
||||
|
||||
return register_nf_nat_bpf();
|
||||
ret = register_nf_nat_bpf();
|
||||
if (ret < 0) {
|
||||
RCU_INIT_POINTER(nf_nat_hook, NULL);
|
||||
nf_ct_helper_expectfn_unregister(&follow_master_nat);
|
||||
synchronize_net();
|
||||
unregister_pernet_subsys(&nat_net_ops);
|
||||
kvfree(nf_nat_bysource);
|
||||
}
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
static void __exit nf_nat_cleanup(void)
|
||||
|
|
Loading…
Reference in a new issue