| Message ID | 20221101115252.17340-1-chenzhongjin@huawei.com (mailing list archive) |
|---|---|
| State | Awaiting Upstream |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net,v2] netfilter: nf_nat: Fix possible memory leak in nf_nat_init() | expand |
On Tue, Nov 01, 2022 at 07:52:52PM +0800, Chen Zhongjin wrote: > In nf_nat_init(), register_nf_nat_bpf() can fail and return directly > without any error handling. > Then nf_nat_bysource will leak and registering of &nat_net_ops, > &follow_master_nat and nf_nat_hook won't be reverted. > > This leaves wild ops in linkedlists and when another module tries to > call register_pernet_operations() or nf_ct_helper_expectfn_register() > it triggers page fault: > > BUG: unable to handle page fault for address: fffffbfff81b964c > RIP: 0010:register_pernet_operations+0x1b9/0x5f0 > Call Trace: > <TASK> > register_pernet_subsys+0x29/0x40 > ebtables_init+0x58/0x1000 [ebtables] > ... > > Fixes: 820dc0523e05 ("net: netfilter: move bpf_ct_set_nat_info kfunc in nf_nat_bpf.c") > Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com> > --- > Also revert the operation for &follow_master_nat and nf_nat_hook, > then slightly fix commit msg for it. Applied, thanks
diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c index 18319a6e6806..47aa67abd531 100644 --- a/net/netfilter/nf_nat_core.c +++ b/net/netfilter/nf_nat_core.c @@ -1152,7 +1152,15 @@ static int __init nf_nat_init(void) WARN_ON(nf_nat_hook != NULL); RCU_INIT_POINTER(nf_nat_hook, &nat_hook); - return register_nf_nat_bpf(); + ret = register_nf_nat_bpf(); + if (ret < 0) { + RCU_INIT_POINTER(nf_nat_hook, NULL); + nf_ct_helper_expectfn_unregister(&follow_master_nat); + synchronize_net(); + unregister_pernet_subsys(&nat_net_ops); + kvfree(nf_nat_bysource); + } + return ret; } static void __exit nf_nat_cleanup(void)
In nf_nat_init(), register_nf_nat_bpf() can fail and return directly without any error handling. Then nf_nat_bysource will leak and registering of &nat_net_ops, &follow_master_nat and nf_nat_hook won't be reverted. This leaves wild ops in linkedlists and when another module tries to call register_pernet_operations() or nf_ct_helper_expectfn_register() it triggers page fault: BUG: unable to handle page fault for address: fffffbfff81b964c RIP: 0010:register_pernet_operations+0x1b9/0x5f0 Call Trace: <TASK> register_pernet_subsys+0x29/0x40 ebtables_init+0x58/0x1000 [ebtables] ... Fixes: 820dc0523e05 ("net: netfilter: move bpf_ct_set_nat_info kfunc in nf_nat_bpf.c") Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com> --- Also revert the operation for &follow_master_nat and nf_nat_hook, then slightly fix commit msg for it. --- net/netfilter/nf_nat_core.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)