]> git.baikalelectronics.ru Git - kernel.git/commit
netfilter: nf_tables: add missing ->release_ops() in error path of newrule()
authorTaehee Yoo <ap420073@gmail.com>
Tue, 19 Mar 2019 04:22:41 +0000 (13:22 +0900)
committerPablo Neira Ayuso <pablo@netfilter.org>
Wed, 20 Mar 2019 07:32:58 +0000 (08:32 +0100)
commit9fb08dabf65779fd7cf1019e9795b50ad9480697
tree7d4239b5e49c3c2686256226d33bdfdfdd75ef10
parent2cab6f3ac8aba9b855f4f0a1a3cb4084914dd2e3
netfilter: nf_tables: add missing ->release_ops() in error path of newrule()

->release_ops() callback releases resources and this is used in error path.
If nf_tables_newrule() fails after ->select_ops(), it should release
resources. but it can not call ->destroy() because that should be called
after ->init().
At this point, ->release_ops() should be used for releasing resources.

Test commands:
   modprobe -rv xt_tcpudp
   iptables-nft -I INPUT -m tcp   <-- error command
   lsmod

Result:
   Module                  Size  Used by
   xt_tcpudp              20480  2      <-- it should be 0

Fixes: 3e2725c2b44e ("netfilter: nft_compat: use .release_ops and remove list of extension")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/netfilter/nf_tables_api.c