Re: [PATCH nf] netfilter: nf_conncount: fix leaked ct in error paths

[Florian Westphal <fw@strlen.de>]

Fernando Fernandez Mancera <fmancera@suse.de> wrote:
> There are some situations where ct might be leaked as error paths are
> skipping the refcounted check and return immediately. In order to solve
> it, call nf_ct_put() as soon as possible or make sure that the check is
> always called.
>
> Fixes: be102eb6a0e7 ("netfilter: nf_conncount: rework API to use sk_buff directly")
> Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
> ---
> Note: this is actually rebased in top of net.git
> ---
>  net/netfilter/nf_conncount.c | 14 ++++++--------
>  1 file changed, 6 insertions(+), 8 deletions(-)
> 
> diff --git a/net/netfilter/nf_conncount.c b/net/netfilter/nf_conncount.c
> index f1be4dd5cf85..09b534fb1b4b 100644
> --- a/net/netfilter/nf_conncount.c
> +++ b/net/netfilter/nf_conncount.c
> @@ -181,6 +181,8 @@ static int __nf_conncount_add(struct net *net,
>  			nf_ct_put(ct);
>  		return -EEXIST;
>  	}
> +	if (refcounted)
> +		nf_ct_put(ct);

I don't think you can put it this early.  Afaics the zone pointer may
point to storage within 'ct', so this has to be deferred or handled
like 'tuple' (copy).