[PATCH nf] netfilter: nft_dynset: missing .clone_destroy call when honoring set expression

[Pablo Neira Ayuso <pablo@netfilter.org>]

If the set definition provides template stateful expressions and the
dynset expression does not specify any, then these template expressions
are cloned without holding refcount on modules because the template
already did this for us.

The expression cloning is usually reserved to allocate expressions in
the packet. However, this mechanism is also used by the dynset
expression to allocate the template dynset expression.

For the connlimit expression, this results in a WARNING splat due to
module refcount imbalance because the destroy path drops the module
refcount when the clone did not bump it.

To address this issue, annotate that these stateful expressions have
cloned from the set, so the destroy path uses .destroy_clone to release
them.

Fixes: fca05d4d61e6 ("netfilter: nft_dynset: honor stateful expressions in set definition")
Reported-by: Xingyuan Mo <hdthky0@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 include/net/netfilter/nf_tables.h |  2 ++
 net/netfilter/nf_tables_api.c     |  4 ++--
 net/netfilter/nft_dynset.c        | 25 ++++++++++++++++++-------
 3 files changed, 22 insertions(+), 9 deletions(-)

diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 238f6ecb90e9..13f8807d05b8 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -874,6 +874,8 @@ int nft_set_elem_expr_clone(const struct nft_ctx *ctx, struct nft_set *set,
 			    struct nft_expr *expr_array[]);
 void nft_set_elem_expr_destroy(const struct nft_ctx *ctx,
 			       struct nft_set_elem_expr *elem_expr);
+void __nft_set_elem_expr_destroy(const struct nft_ctx *ctx,
+				 struct nft_expr *expr);
 void nft_set_elem_destroy(const struct nft_set *set,
 			  const struct nft_elem_priv *elem_priv,
 			  bool destroy_expr);
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 71f4227d7ac7..06b9754d1c25 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -6830,8 +6830,8 @@ struct nft_elem_priv *nft_set_elem_init(const struct nft_set *set,
 	return ERR_PTR(-EINVAL);
 }
 
-static void __nft_set_elem_expr_destroy(const struct nft_ctx *ctx,
-					struct nft_expr *expr)
+void __nft_set_elem_expr_destroy(const struct nft_ctx *ctx,
+				 struct nft_expr *expr)
 {
 	if (expr->ops->destroy_clone) {
 		expr->ops->destroy_clone(ctx, expr);
diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c
index ee9d3e7b1ecf..935a07b47a44 100644
--- a/net/netfilter/nft_dynset.c
+++ b/net/netfilter/nft_dynset.c
@@ -19,7 +19,8 @@ struct nft_dynset {
 	u8				sreg_key;
 	u8				sreg_data;
 	bool				invert;
-	bool				expr;
+	u8				expr:1,
+					cloned:1;
 	u8				num_exprs;
 	u64				timeout;
 	struct nft_expr			*expr_array[NFT_SET_EXPR_MAX];
@@ -168,6 +169,19 @@ static const struct nla_policy nft_dynset_policy[NFTA_DYNSET_MAX + 1] = {
 	[NFTA_DYNSET_EXPRESSIONS] = { .type = NLA_NESTED },
 };
 
+static void nft_dynset_expr_destroy(const struct nft_ctx *ctx,
+				    struct nft_dynset *priv)
+{
+	int i;
+
+	for (i = 0; i < priv->num_exprs; i++) {
+		if (priv->cloned)
+			__nft_set_elem_expr_destroy(ctx, priv->expr_array[i]);
+		else
+			nft_expr_destroy(ctx, priv->expr_array[i]);
+	}
+}
+
 static int nft_dynset_init(const struct nft_ctx *ctx,
 			   const struct nft_expr *expr,
 			   const struct nlattr * const tb[])
@@ -312,6 +326,7 @@ static int nft_dynset_init(const struct nft_ctx *ctx,
 			return err;
 
 		priv->num_exprs = set->num_exprs;
+		priv->cloned = true;
 	}
 
 	nft_set_ext_prepare(&priv->tmpl);
@@ -339,8 +354,7 @@ static int nft_dynset_init(const struct nft_ctx *ctx,
 	return 0;
 
 err_expr_free:
-	for (i = 0; i < priv->num_exprs; i++)
-		nft_expr_destroy(ctx, priv->expr_array[i]);
+	nft_dynset_expr_destroy(ctx, priv);
 	return err;
 }
 
@@ -365,11 +379,8 @@ static void nft_dynset_destroy(const struct nft_ctx *ctx,
 			       const struct nft_expr *expr)
 {
 	struct nft_dynset *priv = nft_expr_priv(expr);
-	int i;
-
-	for (i = 0; i < priv->num_exprs; i++)
-		nft_expr_destroy(ctx, priv->expr_array[i]);
 
+	nft_dynset_expr_destroy(ctx, priv);
 	nf_tables_destroy_set(ctx, priv->set);
 }
 
-- 
2.47.3