From: Liping Zhang Date: Sat, 11 Jun 2016 04:20:28 +0000 (+0800) Subject: netfilter: nf_tables: fix wrong destroy anonymous sets if binding fails X-Git-Tag: v4.1.12-92~24^2~10 X-Git-Url: https://www.infradead.org/git/?a=commitdiff_plain;h=9a091b4bd433c50b4b70612c13664638362ee182;p=users%2Fjedix%2Flinux-maple.git netfilter: nf_tables: fix wrong destroy anonymous sets if binding fails When we add a nft rule like follows: # nft add rule filter test tcp dport vmap {1: jump test} -ELOOP error will be returned, and the anonymous set will be destroyed. But after that, nf_tables_abort will also try to remove the element and destroy the set, which was already destroyed and freed. If we add a nft wrong rule, nft_tables_abort will do the cleanup work rightly, so nf_tables_set_destroy call here is redundant and wrong, remove it. Signed-off-by: Liping Zhang Signed-off-by: Pablo Neira Ayuso (cherry picked from commit a02f424863610a0a7abd80c468839e59cfa4d0d8) Oragbug: 24749203 Signed-off-by: Dhaval Giani Reviewed-by: John Haxby Signed-off-by: Dhaval Giani --- diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index e7d689a11298a..30b6cbd215f58 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -2877,13 +2877,8 @@ int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set, iter.fn = nf_tables_bind_check_setelem; set->ops->walk(ctx, set, &iter); - if (iter.err < 0) { - /* Destroy anonymous sets if binding fails */ - if (set->flags & NFT_SET_ANONYMOUS) - nf_tables_set_destroy(ctx, set); - + if (iter.err < 0) return iter.err; - } } bind: binding->chain = ctx->chain;