diff options
| author | Florian Westphal <fw@strlen.de> | 2018-04-10 09:30:27 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2018-05-22 18:53:58 +0200 |
| commit | d233f8d5bdd39ef13112147d8659bc2f5b9f6b8f (patch) | |
| tree | eb7a515fd247efefe87491ad9ecb56cd00f14b35 /lib/test_bitmap.c | |
| parent | 321bc88ec098845ec93d047858a010d41be26ed9 (diff) | |
netfilter: nf_tables: can't fail after linking rule into active rule list
commit 569ccae68b38654f04b6842b034aa33857f605fe upstream.
rules in nftables a free'd using kfree, but protected by rcu, i.e. we
must wait for a grace period to elapse.
Normal removal patch does this, but nf_tables_newrule() doesn't obey
this rule during error handling.
It calls nft_trans_rule_add() *after* linking rule, and, if that
fails to allocate memory, it unlinks the rule and then kfree() it --
this is unsafe.
Switch order -- first add rule to transaction list, THEN link it
to public list.
Note: nft_trans_rule_add() uses GFP_KERNEL; it will not fail so this
is not a problem in practice (spotted only during code review).
Fixes: 0628b123c96d12 ("netfilter: nfnetlink: add batch support and use it from nf_tables")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'lib/test_bitmap.c')
0 files changed, 0 insertions, 0 deletions