netfilter: nft_socket: fix sk refcount leaks

We must put 'sk' reference before returning.

Fixes: 039b1f4f24ec ("netfilter: nft_socket: fix erroneous socket assignment")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/netfilter/nft_socket.c b/net/netfilter/nft_socket.c
index f30163e..765ffd6 100644 (file)
--- a/net/netfilter/nft_socket.c
+++ b/net/netfilter/nft_socket.c
@@ -110,13 +110,13 @@ static void nft_socket_eval(const struct nft_expr *expr,
                        *dest = READ_ONCE(sk->sk_mark);
                } else {
                        regs->verdict.code = NFT_BREAK;
-                       return;
+                       goto out_put_sk;
                }
                break;
        case NFT_SOCKET_WILDCARD:
                if (!sk_fullsock(sk)) {
                        regs->verdict.code = NFT_BREAK;
-                       return;
+                       goto out_put_sk;
                }
                nft_socket_wildcard(pkt, regs, sk, dest);
                break;
@@ -124,7 +124,7 @@ static void nft_socket_eval(const struct nft_expr *expr,
        case NFT_SOCKET_CGROUPV2:
                if (!nft_sock_get_eval_cgroupv2(dest, sk, pkt, priv->level)) {
                        regs->verdict.code = NFT_BREAK;
-                       return;
+                       goto out_put_sk;
                }
                break;
 #endif
@@ -133,6 +133,7 @@ static void nft_socket_eval(const struct nft_expr *expr,
                regs->verdict.code = NFT_BREAK;
        }
 
+out_put_sk:
        if (sk != skb->sk)
                sock_gen_put(sk);
 }