Commit d6b47866 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nf_tables: fix underflow in object reference counter 



Since ("netfilter: nf_tables: drop map element references from
preparation phase"), integration with commit protocol is better,
therefore drop the workaround that b91d9036 ("netfilter: nf_tables:
fix leaking object reference count") provides.

Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 2b84e215

net/netfilter/nf_tables_api.c

+5 −8
Original line number Diff line number Diff line
@@ -6668,19 +6668,19 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, 
	if (flags)

		*nft_set_ext_flags(ext) = flags;



	if (obj) {

		*nft_set_ext_obj(ext) = obj;

		obj->use++;

	}

	if (ulen > 0) {

		if (nft_set_ext_check(&tmpl, NFT_SET_EXT_USERDATA, ulen) < 0) {

			err = -EINVAL;

			goto err_elem_userdata;

			goto err_elem_free;

		}

		udata = nft_set_ext_userdata(ext);

		udata->len = ulen - 1;

		nla_memcpy(&udata->data, nla[NFTA_SET_ELEM_USERDATA], ulen);

	}

	if (obj) {

		*nft_set_ext_obj(ext) = obj;

		obj->use++;

	}

	err = nft_set_elem_expr_setup(ctx, &tmpl, ext, expr_array, num_exprs);

	if (err < 0)

		goto err_elem_free;
@@ -6735,9 +6735,6 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, 
err_element_clash:

	kfree(trans);

err_elem_free:

	if (obj)

		obj->use--;

err_elem_userdata:

	nft_set_elem_destroy(set, elem.priv, true);

err_parse_data:

	if (nla[NFTA_SET_ELEM_DATA] != NULL)