[PATCH 1/2] netfilter: nf_tables: fix refcount leak when jump to chain is used

[PATCH 1/2] netfilter: nf_tables: fix refcount leak when jump to chain is used

[Pablo Neira Ayuso]

We have to uninit() the data part of the element, otherwise we may
hit a bug trap in the abort path depending on the ruleset.

RIP: 0010:[<ffffffffa07b0547>]  [<ffffffffa07b0547>] nf_tables_chain_destroy+0x24/0x55 [nf_tables]
[...]
Call Trace:
 [<ffffffffa07b0f2d>] nf_tables_abort+0x245/0x287 [nf_tables]
 [<ffffffffa06378ee>] nfnetlink_rcv_batch+0x2c8/0x457 [nfnetlink]
 [<ffffffffa06379a7>] ? nfnetlink_rcv_batch+0x381/0x457 [nfnetlink]

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/netfilter/nft_hash.c   |    2 +-
 net/netfilter/nft_rbtree.c |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/netfilter/nft_hash.c b/net/netfilter/nft_hash.c
index 61e6c40..87ec456 100644
--- a/net/netfilter/nft_hash.c
+++ b/net/netfilter/nft_hash.c
@@ -86,7 +86,7 @@ static void nft_hash_remove(const struct nft_set *set,
 
 	rhashtable_remove(priv, elem->cookie);
 	synchronize_rcu();
-	kfree(elem->cookie);
+	nft_hash_elem_destroy(set, elem->cookie);
 }
 
 struct nft_compare_arg {
diff --git a/net/netfilter/nft_rbtree.c b/net/netfilter/nft_rbtree.c
index 46214f2..5089f55 100644
--- a/net/netfilter/nft_rbtree.c
+++ b/net/netfilter/nft_rbtree.c
@@ -148,7 +148,7 @@ static void nft_rbtree_remove(const struct nft_set *set,
 	spin_lock_bh(&nft_rbtree_lock);
 	rb_erase(&rbe->node, &priv->root);
 	spin_unlock_bh(&nft_rbtree_lock);
-	kfree(rbe);
+	nft_rbtree_elem_destroy(set, rbe);
 }
 
 static int nft_rbtree_get(const struct nft_set *set, struct nft_set_elem *elem)
-- 
1.7.10.4

[PATCH 2/2] netfilter: nf_tables: don't uninitialize element from core

[Pablo Neira Ayuso]

The corresponding set implementation is responsible for this when
destroying the element. This prevents a table refcount underflow
when deleting elements.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/netfilter/nf_tables_api.c |    5 -----
 1 file changed, 5 deletions(-)

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 199fd0f..d49aa91 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -3613,11 +3613,6 @@ static int nf_tables_commit(struct sk_buff *skb)
 						 NFT_MSG_DELSETELEM, 0);
 			te->set->ops->get(te->set, &te->elem);
 			te->set->ops->remove(te->set, &te->elem);
-			nft_data_uninit(&te->elem.key, NFT_DATA_VALUE);
-			if (te->elem.flags & NFT_SET_MAP) {
-				nft_data_uninit(&te->elem.data,
-						te->set->dtype);
-			}
 			nft_trans_destroy(trans);
 			break;
 		}
-- 
1.7.10.4