Re: [PATCH v2 nf] netfilter: nf_tables: fix memory leak during stateful obj update

[Florian Westphal <fw@strlen.de>]

Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> On Sun, Feb 20, 2022 at 12:18:50PM +0100, Florian Westphal wrote:
> > stateful objects can be updated from the control plane.
> > The transaction logic allocates a temporary object for this purpose.
> > 
> > This object has to be released via nft_obj_destroy, not kfree, since
> > the ->init function was called and it can have side effects beyond
> > memory allocation.
> > 
> > Unlike normal NEWOBJ path, the objects module refcount isn't
> > incremented, so add nft_newobj_destroy and use that.
> 
> Probably this? .udata and .key is NULL for the update path so kfree
> should be fine.

Yes, that works too.

We could also ...

> -	module_put(obj->ops->type->owner);
> +	/* nf_tables_updobj does not increment module refcount */
> +	if (!update)
> +		module_put(obj->ops->type->owner);
> +

Increment the refcount for update case as well to avoid the special
case?