https://github.com/torvalds/linux
Revision cf5000a7787cbc10341091d37245a42c119d26c5 authored by Florian Westphal on 19 September 2023, 13:36:13 UTC, committed by Florian Westphal on 20 September 2023, 08:35:23 UTC
When more than 255 elements expired we're supposed to switch to a new gc
container structure.

This never happens: u8 type will wrap before reaching the boundary
and nft_trans_gc_space() always returns true.

This means we recycle the initial gc container structure and
lose track of the elements that came before.

While at it, don't deref 'gc' after we've passed it to call_rcu.

Fixes: 5f68718b34a5 ("netfilter: nf_tables: GC transaction API to avoid race with control plane")
Reported-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
1 parent c9bd265
History
Tip revision: cf5000a7787cbc10341091d37245a42c119d26c5 authored by Florian Westphal on 19 September 2023, 13:36:13 UTC
netfilter: nf_tables: fix memleak when more than 255 elements expired
Tip revision: cf5000a
File Mode Size
Documentation
LICENSES
arch
block
certs
crypto
drivers
fs
include
init
io_uring
ipc
kernel
lib
mm
net
rust
samples
scripts
security
sound
tools
usr
virt
.clang-format -rw-r--r-- 20.1 KB
.cocciconfig -rw-r--r-- 59 bytes
.get_maintainer.ignore -rw-r--r-- 151 bytes
.gitattributes -rw-r--r-- 105 bytes
.gitignore -rw-r--r-- 2.0 KB
.mailmap -rw-r--r-- 35.6 KB
.rustfmt.toml -rw-r--r-- 369 bytes
COPYING -rw-r--r-- 496 bytes
CREDITS -rw-r--r-- 100.0 KB
Kbuild -rw-r--r-- 2.5 KB
Kconfig -rw-r--r-- 555 bytes
MAINTAINERS -rw-r--r-- 709.5 KB
Makefile -rw-r--r-- 65.9 KB
README -rw-r--r-- 727 bytes

README

back to top