github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-23 05:04:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

netfilter: nf_nat: unregister and release hooks on error

Browse Source 
If nf_hook_entries_insert_raw() fails, the NAT hooks get never released,
resulting in a memleak.

Postpone setting nat_proto_net->nat_hook_ops when the hooks are
registered to simplify the error path to decide whether the nat hooks
need unwinding.

Fixes: 1cd472bf03 ("netfilter: nf_nat: add nat hook register functions to nf_nat")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Pablo Neira Ayuso 2026-09-03 01:28:56 +02:00
parent 444e4c88c9
commit cbdd39ce42
1 changed files with 30 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

46
net/netfilter/nf_nat_core.c
View File

@ -1224,31 +1224,45 @@ int nf_nat_register_fn(struct net *net, u8 pf, const struct nf_hook_ops *ops,
}
ret = nf_register_net_hooks(net, nat_ops, ops_count);
if (ret < 0) {
mutex_unlock(&nf_nat_proto_mutex);
for (i = 0; i < ops_count; i++) {
priv = nat_ops[i].priv;
kfree_rcu(priv, rcu_head);
}
kfree_rcu(nat_ops, rcu);
return ret;
}
nat_proto_net->nat_hook_ops = nat_ops;
if (ret < 0)
goto err_free_hooks;
} else {
nat_ops = nat_proto_net->nat_hook_ops;
}
nat_ops = nat_proto_net->nat_hook_ops;
priv = nat_ops[hooknum].priv;
if (WARN_ON_ONCE(!priv)) {
mutex_unlock(&nf_nat_proto_mutex);
return -EOPNOTSUPP;
ret = -EOPNOTSUPP;
goto err_unregister_hooks;
}
ret = nf_hook_entries_insert_raw(&priv->entries, ops);
if (ret == 0)
nat_proto_net->users++;
if (ret)
goto err_unregister_hooks;
if (!nat_proto_net->nat_hook_ops)
nat_proto_net->nat_hook_ops = nat_ops;
nat_proto_net->users++;
mutex_unlock(&nf_nat_proto_mutex);
return 0;
err_unregister_hooks:
if (nat_proto_net->nat_hook_ops) {
mutex_unlock(&nf_nat_proto_mutex);
return ret;
}
nf_unregister_net_hooks(net, nat_ops, ops_count);
err_free_hooks:
mutex_unlock(&nf_nat_proto_mutex);
for (i = 0; i < ops_count; i++) {
priv = nat_ops[i].priv;
kfree_rcu(priv, rcu_head);
}
kfree_rcu(nat_ops, rcu);
return ret;
}