Commit 6c2d2176 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: ctnetlink: memleak in filter initialization error path 



Release the filter object in case of error.

Fixes: cb8aa9a3 ("netfilter: ctnetlink: add kernel side filtering for dump")
Reported-by: default avatar <syzbot+38b8b548a851a01793c5@syzkaller.appspotmail.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent c3829285

net/netfilter/nf_conntrack_netlink.c

+22 −10
Original line number Original line Diff line number Diff line
@@ -939,7 +939,8 @@ ctnetlink_alloc_filter(const struct nlattr * const cda[], u8 family) 
			filter->mark.mask = 0xffffffff;

			filter->mark.mask = 0xffffffff;

		}

		}

	} else if (cda[CTA_MARK_MASK]) {

	} else if (cda[CTA_MARK_MASK]) {

		return ERR_PTR(-EINVAL);

		err = -EINVAL;

		goto err_filter;

	}

	}

#endif

#endif

	if (!cda[CTA_FILTER])

	if (!cda[CTA_FILTER])
@@ -947,15 +948,17 @@ ctnetlink_alloc_filter(const struct nlattr * const cda[], u8 family) 




	err = ctnetlink_parse_zone(cda[CTA_ZONE], &filter->zone);

	err = ctnetlink_parse_zone(cda[CTA_ZONE], &filter->zone);

	if (err < 0)

	if (err < 0)

		return ERR_PTR(err);

		goto err_filter;





	err = ctnetlink_parse_filter(cda[CTA_FILTER], filter);

	err = ctnetlink_parse_filter(cda[CTA_FILTER], filter);

	if (err < 0)

	if (err < 0)

		return ERR_PTR(err);

		goto err_filter;





	if (filter->orig_flags) {

	if (filter->orig_flags) {

		if (!cda[CTA_TUPLE_ORIG])

		if (!cda[CTA_TUPLE_ORIG]) {

			return ERR_PTR(-EINVAL);

			err = -EINVAL;

			goto err_filter;

		}





		err = ctnetlink_parse_tuple_filter(cda, &filter->orig,

		err = ctnetlink_parse_tuple_filter(cda, &filter->orig,

						   CTA_TUPLE_ORIG,

						   CTA_TUPLE_ORIG,
@@ -963,23 +966,32 @@ ctnetlink_alloc_filter(const struct nlattr * const cda[], u8 family) 
						   &filter->zone,

						   &filter->zone,

						   filter->orig_flags);

						   filter->orig_flags);

		if (err < 0)

		if (err < 0)

			return ERR_PTR(err);

			goto err_filter;

	}

	}





	if (filter->reply_flags) {

	if (filter->reply_flags) {

		if (!cda[CTA_TUPLE_REPLY])

		if (!cda[CTA_TUPLE_REPLY]) {

			return ERR_PTR(-EINVAL);

			err = -EINVAL;

			goto err_filter;

		}





		err = ctnetlink_parse_tuple_filter(cda, &filter->reply,

		err = ctnetlink_parse_tuple_filter(cda, &filter->reply,

						   CTA_TUPLE_REPLY,

						   CTA_TUPLE_REPLY,

						   filter->family,

						   filter->family,

						   &filter->zone,

						   &filter->zone,

						   filter->orig_flags);

						   filter->orig_flags);

		if (err < 0)

		if (err < 0) {

			return ERR_PTR(err);

			err = -EINVAL;

			goto err_filter;

		}

	}

	}





	return filter;

	return filter;



err_filter:

	kfree(filter);



	return ERR_PTR(err);

}

}





static bool ctnetlink_needs_filter(u8 family, const struct nlattr * const *cda)

static bool ctnetlink_needs_filter(u8 family, const struct nlattr * const *cda)