Commit c485c35f authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nf_tables: possible module reference underflow in error path 



dst->ops is set on when nft_expr_clone() fails, but module refcount has
not been bumped yet, therefore nft_expr_destroy() leads to module
reference underflow.

Fixes: 8cfd9b0f ("netfilter: nftables: generalize set expressions support")
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 4963674c

net/netfilter/nf_tables_api.c

+1 −1
Original line number Diff line number Diff line
@@ -5601,7 +5601,7 @@ int nft_set_elem_expr_clone(const struct nft_ctx *ctx, struct nft_set *set, 


		err = nft_expr_clone(expr, set->exprs[i]);

		if (err < 0) {

			nft_expr_destroy(ctx, expr);

			kfree(expr);

			goto err_expr;

		}

		expr_array[i] = expr;