summaryrefslogtreecommitdiff
path: root/include
diff options
context:
space:
mode:
authorFelix Fietkau <nbd@nbd.name>2018-02-07 11:49:02 +0300
committerPablo Neira Ayuso <pablo@netfilter.org>2018-02-07 13:55:52 +0300
commit0ff90b6c20340e57616a51ae1a1bf18156d6638a (patch)
treeea8f92d7b66248c515234e119819aa620ef77a33 /include
parentd8ed9600581d40d818ae417b3086a333841b0559 (diff)
downloadlinux-0ff90b6c20340e57616a51ae1a1bf18156d6638a.tar.xz
netfilter: nf_flow_offload: fix use-after-free and a resource leak
flow_offload_del frees the flow, so all associated resource must be freed before. Since the ct entry in struct flow_offload_entry was allocated by flow_offload_alloc, it should be freed by flow_offload_free to take care of the error handling path when flow_offload_add fails. While at it, make flow_offload_del static, since it should never be called directly, only from the gc step Signed-off-by: Felix Fietkau <nbd@nbd.name> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'include')
-rw-r--r--include/net/netfilter/nf_flow_table.h1
1 files changed, 0 insertions, 1 deletions
diff --git a/include/net/netfilter/nf_flow_table.h b/include/net/netfilter/nf_flow_table.h
index 020ae903066f..833752dd0c58 100644
--- a/include/net/netfilter/nf_flow_table.h
+++ b/include/net/netfilter/nf_flow_table.h
@@ -90,7 +90,6 @@ struct flow_offload *flow_offload_alloc(struct nf_conn *ct,
void flow_offload_free(struct flow_offload *flow);
int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow);
-void flow_offload_del(struct nf_flowtable *flow_table, struct flow_offload *flow);
struct flow_offload_tuple_rhash *flow_offload_lookup(struct nf_flowtable *flow_table,
struct flow_offload_tuple *tuple);
int nf_flow_table_iterate(struct nf_flowtable *flow_table,