[PATCH net] netfilter: nf_tables: Fix memory leak in nf_flow_offload_xdp_setup()

[PATCH net] netfilter: nf_tables: Fix memory leak in nf_flow_offload_xdp_setup()

[Lorenzo Bianconi]

nf_flow_offload_xdp_setup routine allocates/removes entries in
nf_xdp_hashtable hash running FLOW_BLOCK_BIND/FLOW_BLOCK_UNBIND
commands. In the current codebase we have an FLOW_BLOCK_BIND/
FLOW_BLOCK_UNBIND unbalance since we do not run FLOW_BLOCK_UNBIND in
__nft_unregister_flowtable_net_hooks() triggering the following error
reported by kmeamlak:

[<00000000be65a589>] __kmalloc_cache_noprof+0x280/0x310
[<00000000c6569ad4>] nf_flow_offload_xdp_setup+0x70/0x8d0 [nf_flow_table]
[<000000001efe6e35>] nf_flow_table_offload_setup+0x324/0x610 [nf_flow_table]
[<000000005d9c9ad6>] nft_register_flowtable_net_hooks+0x3f4/0x890 [nf_tables]
[<00000000de9071ee>] nf_tables_newflowtable+0xf61/0x18c0 [nf_tables]
[<00000000924f5d86>] nfnetlink_rcv_batch+0x12c1/0x1c50 [nfnetlink]
[<000000003fa07104>] nfnetlink_rcv+0x2a3/0x320 [nfnetlink]
[<000000009fd1c990>] netlink_unicast+0x588/0x7f0
[<00000000ee126795>] netlink_sendmsg+0x702/0xba0
[<000000000ddf29fb>] ____sys_sendmsg+0x7cd/0x9a0
[<0000000027b80416>] ___sys_sendmsg+0xd6/0x140
[<00000000edfe1eb5>] __sys_sendmsg+0xba/0x150
[<000000009d5eb571>] do_syscall_64+0x47/0x110
[<0000000077c3a21e>] entry_SYSCALL_64_after_hwframe+0x76/0x7e

Fix the issue running FLOW_BLOCK_UNBIND command in
__nft_unregister_flowtable_net_hooks() if the nft_hook is removed.

Fixes: 89cc8f1c5f22 ("netfilter: nf_tables: Add flowtable map for xdp offload")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
---
 net/netfilter/nf_tables_api.c | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index a24fe62650a753be872a2051b34ff0aba27ef8c4..53357b61700b01048e840154dffd55a2c05062c1 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -8546,14 +8546,18 @@ static void nft_unregister_flowtable_hook(struct net *net,
 }
 
 static void __nft_unregister_flowtable_net_hooks(struct net *net,
-						 struct list_head *hook_list,
-					         bool release_netdev)
+						 struct nft_flowtable *flowtable,
+						 struct list_head *hook_list)
 {
 	struct nft_hook *hook, *next;
 
 	list_for_each_entry_safe(hook, next, hook_list, list) {
+		if (flowtable)
+			flowtable->data.type->setup(&flowtable->data,
+						    hook->ops.dev,
+						    FLOW_BLOCK_UNBIND);
 		nf_unregister_net_hook(net, &hook->ops);
-		if (release_netdev) {
+		if (flowtable) {
 			list_del(&hook->list);
 			kfree_rcu(hook, rcu);
 		}
@@ -8563,7 +8567,7 @@ static void __nft_unregister_flowtable_net_hooks(struct net *net,
 static void nft_unregister_flowtable_net_hooks(struct net *net,
 					       struct list_head *hook_list)
 {
-	__nft_unregister_flowtable_net_hooks(net, hook_list, false);
+	__nft_unregister_flowtable_net_hooks(net, NULL, hook_list);
 }
 
 static int nft_register_flowtable_net_hooks(struct net *net,
@@ -11459,8 +11463,8 @@ static void __nft_release_hook(struct net *net, struct nft_table *table)
 	list_for_each_entry(chain, &table->chains, list)
 		__nf_tables_unregister_hook(net, table, chain, true);
 	list_for_each_entry(flowtable, &table->flowtables, list)
-		__nft_unregister_flowtable_net_hooks(net, &flowtable->hook_list,
-						     true);
+		__nft_unregister_flowtable_net_hooks(net, flowtable,
+						     &flowtable->hook_list);
 }
 
 static void __nft_release_hooks(struct net *net)

---
base-commit: 1d227fcc72223cbdd34d0ce13541cbaab5e0d72f
change-id: 20241011-flowtable-xdp-memleak-05cdd4c22369

Best regards,
-- 
Lorenzo Bianconi <lorenzo@kernel.org>