Xin Xiong 0036c78c49 netfilter: ipt_CLUSTERIP: fix refcount leak in clusterip_tg_check() ...

[ Upstream commit d94a69cb2c ]

The issue takes place in one error path of clusterip_tg_check(). When
memcmp() returns nonzero, the function simply returns the error code,
forgetting to decrease the reference count of a clusterip_config
object, which is bumped earlier by clusterip_config_find_get(). This
may incur reference count leak.

Fix this issue by decrementing the refcount of the object in specific
error path.

Fixes: 06aa151ad1 ("netfilter: ipt_CLUSTERIP: check MAC address when duplicate config is set")
Signed-off-by: Xin Xiong <xiongx18@fudan.edu.cn>
Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2022-01-27 10:54:00 +01:00

..

arp_tables.c

netfilter: arp_tables: add pre_exit hook for table unregister

2021-04-21 13:00:56 +02:00

arpt_mangle.c

…

arptable_filter.c

netfilter: arp_tables: add pre_exit hook for table unregister

2021-04-21 13:00:56 +02:00

ip_tables.c

netfilter: x_tables: fix compat match/target pad out-of-bound write

2021-04-16 11:43:21 +02:00

ipt_ah.c

…

ipt_CLUSTERIP.c

netfilter: ipt_CLUSTERIP: fix refcount leak in clusterip_tg_check()

2022-01-27 10:54:00 +01:00

ipt_ECN.c

…

ipt_REJECT.c

…

ipt_rpfilter.c

…

ipt_SYNPROXY.c

…

iptable_filter.c

…

iptable_mangle.c

…

iptable_nat.c

…

iptable_raw.c

…

iptable_security.c

…

Kconfig

…

Makefile

…

nf_defrag_ipv4.c

…

nf_dup_ipv4.c

…

nf_flow_table_ipv4.c

…

nf_log_arp.c

…

nf_log_ipv4.c

…

nf_nat_h323.c

…

nf_nat_pptp.c

…

nf_nat_snmp_basic_main.c

…

nf_nat_snmp_basic.asn1

…

nf_reject_ipv4.c

…

nf_socket_ipv4.c

…

nf_tproxy_ipv4.c

…

nft_dup_ipv4.c

…

nft_fib_ipv4.c

…

nft_reject_ipv4.c

…