Browse Source

netfilter: xt_hashlimit: fix a possible memory leak in htable_create()

In the htable_create(), hinfo is allocated by vmalloc()
So that if error occurred, hinfo should be freed.

Fixes: 11d5f15723c9 ("netfilter: xt_hashlimit: Create revision 2 to support higher pps rates")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Taehee Yoo 6 years ago
parent
commit
b4e955e9f3
1 changed files with 3 additions and 6 deletions
  1. 3 6
      net/netfilter/xt_hashlimit.c

+ 3 - 6
net/netfilter/xt_hashlimit.c

@@ -295,9 +295,10 @@ static int htable_create(struct net *net, struct hashlimit_cfg3 *cfg,
 
 
 	/* copy match config into hashtable config */
 	/* copy match config into hashtable config */
 	ret = cfg_copy(&hinfo->cfg, (void *)cfg, 3);
 	ret = cfg_copy(&hinfo->cfg, (void *)cfg, 3);
-
-	if (ret)
+	if (ret) {
+		vfree(hinfo);
 		return ret;
 		return ret;
+	}
 
 
 	hinfo->cfg.size = size;
 	hinfo->cfg.size = size;
 	if (hinfo->cfg.max == 0)
 	if (hinfo->cfg.max == 0)
@@ -814,7 +815,6 @@ hashlimit_mt_v1(const struct sk_buff *skb, struct xt_action_param *par)
 	int ret;
 	int ret;
 
 
 	ret = cfg_copy(&cfg, (void *)&info->cfg, 1);
 	ret = cfg_copy(&cfg, (void *)&info->cfg, 1);
-
 	if (ret)
 	if (ret)
 		return ret;
 		return ret;
 
 
@@ -830,7 +830,6 @@ hashlimit_mt_v2(const struct sk_buff *skb, struct xt_action_param *par)
 	int ret;
 	int ret;
 
 
 	ret = cfg_copy(&cfg, (void *)&info->cfg, 2);
 	ret = cfg_copy(&cfg, (void *)&info->cfg, 2);
-
 	if (ret)
 	if (ret)
 		return ret;
 		return ret;
 
 
@@ -921,7 +920,6 @@ static int hashlimit_mt_check_v1(const struct xt_mtchk_param *par)
 		return ret;
 		return ret;
 
 
 	ret = cfg_copy(&cfg, (void *)&info->cfg, 1);
 	ret = cfg_copy(&cfg, (void *)&info->cfg, 1);
-
 	if (ret)
 	if (ret)
 		return ret;
 		return ret;
 
 
@@ -940,7 +938,6 @@ static int hashlimit_mt_check_v2(const struct xt_mtchk_param *par)
 		return ret;
 		return ret;
 
 
 	ret = cfg_copy(&cfg, (void *)&info->cfg, 2);
 	ret = cfg_copy(&cfg, (void *)&info->cfg, 2);
-
 	if (ret)
 	if (ret)
 		return ret;
 		return ret;