netfilter: xt_CT: fix refcnt leak on error path (470acf55) · Commits · 戴 / test

There are two cases which causes refcnt leak. 1. When nf_ct_timeout_ext_add failed in xt_ct_set_timeout, it should free the timeout refcnt. Now goto the err_put_timeout error handler instead of going ahead. 2. When the time policy is not found, we should call module_put. Otherwise, the related cthelper module cannot be removed anymore. It is easy to reproduce by typing the following command: # iptables -t raw -A OUTPUT -p tcp -j CT --helper ftp --timeout xxx Signed-off-by:

Gao Feng <fgao@ikuai8.com> Signed-off-by:

Liping Zhang <zlpnobody@gmail.com> Signed-off-by:

Pablo Neira Ayuso <pablo@netfilter.org>

net/netfilter/xt_CT.c

+9 −2

Original line number	Diff line number	Diff line
		@@ -167,8 +167,10 @@ xt_ct_set_timeout(struct nf_conn ct, const struct xt_tgchk_param par,
		goto err_put_timeout;
		}
		timeout_ext = nf_ct_timeout_ext_add(ct, timeout, GFP_ATOMIC);
		if (timeout_ext == NULL)
		if (!timeout_ext) {
		ret = -ENOMEM;
		goto err_put_timeout;
		}

		rcu_read_unlock();
		return ret;
		@@ -200,6 +202,7 @@ static int xt_ct_tg_check(const struct xt_tgchk_param *par,
		struct xt_ct_target_info_v1 *info)
		{
		struct nf_conntrack_zone zone;
		struct nf_conn_help *help;
		struct nf_conn *ct;
		int ret = -EOPNOTSUPP;

		@@ -248,7 +251,7 @@ static int xt_ct_tg_check(const struct xt_tgchk_param *par,
		if (info->timeout[0]) {
		ret = xt_ct_set_timeout(ct, par, info->timeout);
		if (ret < 0)
		goto err3;
		goto err4;
		}
		__set_bit(IPS_CONFIRMED_BIT, &ct->status);
		nf_conntrack_get(&ct->ct_general);
		@@ -256,6 +259,10 @@ out:
		info->ct = ct;
		return 0;

		err4:
		help = nfct_help(ct);
		if (help)
		module_put(help->helper->me);
		err3:
		nf_ct_tmpl_free(ct);
		err2:

Admin message