diff options
| author | Florian Westphal <fw@strlen.de> | 2023-09-19 15:36:13 +0200 |
|---|---|---|
| committer | Florian Westphal <fw@strlen.de> | 2023-09-20 10:35:23 +0200 |
| commit | cf5000a7787cbc10341091d37245a42c119d26c5 (patch) | |
| tree | 0914e619889af02133e4a2378693313649fdfa9b /include | |
| parent | c9bd26513b3a11b3adb3c2ed8a31a01a87173ff1 (diff) | |
| download | lwn-cf5000a7787cbc10341091d37245a42c119d26c5.tar.gz lwn-cf5000a7787cbc10341091d37245a42c119d26c5.zip | |
netfilter: nf_tables: fix memleak when more than 255 elements expired
When more than 255 elements expired we're supposed to switch to a new gc
container structure.
This never happens: u8 type will wrap before reaching the boundary
and nft_trans_gc_space() always returns true.
This means we recycle the initial gc container structure and
lose track of the elements that came before.
While at it, don't deref 'gc' after we've passed it to call_rcu.
Fixes: 5f68718b34a5 ("netfilter: nf_tables: GC transaction API to avoid race with control plane")
Reported-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
Diffstat (limited to 'include')
| -rw-r--r-- | include/net/netfilter/nf_tables.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h index a4455f4995ab..7c816359d5a9 100644 --- a/include/net/netfilter/nf_tables.h +++ b/include/net/netfilter/nf_tables.h @@ -1682,7 +1682,7 @@ struct nft_trans_gc { struct net *net; struct nft_set *set; u32 seq; - u8 count; + u16 count; void *priv[NFT_TRANS_GC_BATCHCOUNT]; struct rcu_head rcu; }; |