netfilter: nf_nat: Fix possible memory leak in nf_nat_init()
authorChen Zhongjin <chenzhongjin@huawei.com>
Tue, 1 Nov 2022 11:52:52 +0000 (19:52 +0800)
committerPablo Neira Ayuso <pablo@netfilter.org>
Wed, 2 Nov 2022 09:47:22 +0000 (10:47 +0100)
commitcbc1dd5b659f5a2c3cba88b197b7443679bb35a0
tree32c6921e0fd126b74b3479e85b90e461d8f99675
parent5663ed63adb9619c98ab7479aa4606fa9b7a548c
netfilter: nf_nat: Fix possible memory leak in nf_nat_init()

In nf_nat_init(), register_nf_nat_bpf() can fail and return directly
without any error handling.
Then nf_nat_bysource will leak and registering of &nat_net_ops,
&follow_master_nat and nf_nat_hook won't be reverted.

This leaves wild ops in linkedlists and when another module tries to
call register_pernet_operations() or nf_ct_helper_expectfn_register()
it triggers page fault:

 BUG: unable to handle page fault for address: fffffbfff81b964c
 RIP: 0010:register_pernet_operations+0x1b9/0x5f0
 Call Trace:
 <TASK>
  register_pernet_subsys+0x29/0x40
  ebtables_init+0x58/0x1000 [ebtables]
  ...

Fixes: 820dc0523e05 ("net: netfilter: move bpf_ct_set_nat_info kfunc in nf_nat_bpf.c")
Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/netfilter/nf_nat_core.c