Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/1.2/patches/2224268/?format=api
{ "id": 2224268, "url": "http://patchwork.ozlabs.org/api/1.2/patches/2224268/?format=api", "web_url": "http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260417081855.3253507-1-1468888505@139.com/", "project": { "id": 26, "url": "http://patchwork.ozlabs.org/api/1.2/projects/26/?format=api", "name": "Netfilter Development", "link_name": "netfilter-devel", "list_id": "netfilter-devel.vger.kernel.org", "list_email": "netfilter-devel@vger.kernel.org", "web_url": null, "scm_url": null, "webscm_url": null, "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<20260417081855.3253507-1-1468888505@139.com>", "list_archive_url": null, "date": "2026-04-17T08:18:55", "name": "[6.6.y] nf_tables: nft_dynset: fix possible stateful expression memleak in error path", "commit_ref": null, "pull_url": null, "state": "new", "archived": false, "hash": "8534fe2a3d3002e2a1bca18a76b07882ddb883bd", "submitter": { "id": 92514, "url": "http://patchwork.ozlabs.org/api/1.2/people/92514/?format=api", "name": "Li hongliang", "email": "1468888505@139.com" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260417081855.3253507-1-1468888505@139.com/mbox/", "series": [ { "id": 500270, "url": "http://patchwork.ozlabs.org/api/1.2/series/500270/?format=api", "web_url": "http://patchwork.ozlabs.org/project/netfilter-devel/list/?series=500270", "date": "2026-04-17T08:18:55", "name": "[6.6.y] nf_tables: nft_dynset: fix possible stateful expression memleak in error path", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/500270/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2224268/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2224268/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "\n <netfilter-devel+bounces-11985-incoming=patchwork.ozlabs.org@vger.kernel.org>", "X-Original-To": [ "incoming@patchwork.ozlabs.org", "netfilter-devel@vger.kernel.org" ], "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=pass (1024-bit key;\n unprotected) header.d=139.com header.i=@139.com header.a=rsa-sha256\n header.s=dkim header.b=a9wdqAzv;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c04:e001:36c::12fc:5321; helo=tor.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-11985-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)", "smtp.subspace.kernel.org;\n\tdkim=pass (1024-bit key) header.d=139.com header.i=@139.com\n header.b=\"a9wdqAzv\"", "smtp.subspace.kernel.org;\n arc=none smtp.client-ip=120.232.169.110", "smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=139.com", "smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=139.com" ], "Received": [ "from tor.lore.kernel.org (tor.lore.kernel.org\n [IPv6:2600:3c04:e001:36c::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fxp1B0b9yz1yGt\n\tfor <incoming@patchwork.ozlabs.org>; Fri, 17 Apr 2026 18:28:14 +1000 (AEST)", "from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby tor.lore.kernel.org (Postfix) with ESMTP id 551B3319719C\n\tfor <incoming@patchwork.ozlabs.org>; Fri, 17 Apr 2026 08:19:30 +0000 (UTC)", "from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id D16763A9DA9;\n\tFri, 17 Apr 2026 08:19:14 +0000 (UTC)", "from n169-110.mail.139.com (n169-110.mail.139.com [120.232.169.110])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id C4F4631F9A2;\n\tFri, 17 Apr 2026 08:19:09 +0000 (UTC)", "from NTT-kernel-dev (unknown[60.247.85.88])\n\tby rmsmtp-lg-appmail-06-12084 (RichMail) with SMTP id 2f3469e1ecee885-018a3;\n\tFri, 17 Apr 2026 16:18:56 +0800 (CST)" ], "ARC-Seal": "i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1776413954; cv=none;\n b=c64xTTGEIczTUaEaSku7EOSA9ZRNqr42O87z5ZLZ2ME+pj+DWh1ZR5rZLG2agd7TvFAoV5blxtcM8Q88VZcsrBhLxm8PszK3Te77/OJQSo+7jAyujBQTOvFGzTb+mvwduaxmBl+ayZ365zf1m08oAS14Cd5Aua7I6tXHv+QCnGU=", "ARC-Message-Signature": "i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1776413954; c=relaxed/simple;\n\tbh=QbLpK6Wf1dh+6c+9JcRpmGxBpKpzCVk9xfGNjuzc8Lo=;\n\th=From:To:Cc:Subject:Date:Message-Id:MIME-Version:Content-Type;\n b=OufEsmBcCThG/qyijiUuYtVdYW2JGkpsoCqaaBwzR/21M6MrIYSTvfDrcFMf4gQ0f29lHgg9irNcmePfk7t+HsmD18sC9aEv9fQMSkjpllIl/Told7n/5Vdkpfg4VKgtBjBO7bbHehtMpP0V4N7AG38lRIXH0i6WMQv7xBtMyBk=", "ARC-Authentication-Results": "i=1; smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=139.com;\n spf=pass smtp.mailfrom=139.com;\n dkim=pass (1024-bit key) header.d=139.com header.i=@139.com\n header.b=a9wdqAzv; arc=none smtp.client-ip=120.232.169.110", "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=139.com; s=dkim; l=0;\n\th=from:subject:message-id:to:cc:mime-version;\n\tbh=47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=;\n\tb=a9wdqAzvmfD+h1ADj0/cwLbu9NXym1xRap+5BYwGq47X3KrxfNPZiwLmYyeEJdm6UFlTZEfC29MX8\n\t EeyBE2jBfn0GQM8a1bIGIo0FQzYKi/Ro8QJYBiKIKUwoiHLA9ord3s8Jl1lVuKeV0UHLBRirsjYYwx\n\t WNRTlGa0aeJx+EZY=", "X-RM-TagInfo": "emlType=0 ", "X-RM-SPAM": "", "X-RM-SPAM-FLAG": "00000000", "X-RM-TRANSID": "2f3469e1ecee885-018a3", "From": "Li hongliang <1468888505@139.com>", "To": "gregkh@linuxfoundation.org,\n\tstable@vger.kernel.org,\n\tpablo@netfilter.org", "Cc": "patches@lists.linux.dev,\n\tlinux-kernel@vger.kernel.org,\n\tkadlec@netfilter.org,\n\tfw@strlen.de,\n\tdavem@davemloft.net,\n\tedumazet@google.com,\n\tkuba@kernel.org,\n\tpabeni@redhat.com,\n\tnetfilter-devel@vger.kernel.org,\n\tcoreteam@netfilter.org,\n\tnetdev@vger.kernel.org,\n\tgiki.shergill@proton.me", "Subject": "[PATCH 6.6.y] nf_tables: nft_dynset: fix possible stateful expression\n memleak in error path", "Date": "Fri, 17 Apr 2026 16:18:55 +0800", "Message-Id": "<20260417081855.3253507-1-1468888505@139.com>", "X-Mailer": "git-send-email 2.34.1", "Precedence": "bulk", "X-Mailing-List": "netfilter-devel@vger.kernel.org", "List-Id": "<netfilter-devel.vger.kernel.org>", "List-Subscribe": "<mailto:netfilter-devel+subscribe@vger.kernel.org>", "List-Unsubscribe": "<mailto:netfilter-devel+unsubscribe@vger.kernel.org>", "MIME-Version": "1.0", "Content-Type": "text/plain; charset=UTF-8", "Content-Transfer-Encoding": "8bit" }, "content": "From: Pablo Neira Ayuso <pablo@netfilter.org>\n\n[ Upstream commit 0548a13b5a145b16e4da0628b5936baf35f51b43 ]\n\nIf cloning the second stateful expression in the element via GFP_ATOMIC\nfails, then the first stateful expression remains in place without being\nreleased.\n\n unreferenced object (percpu) 0x607b97e9cab8 (size 16):\n comm \"softirq\", pid 0, jiffies 4294931867\n hex dump (first 16 bytes on cpu 3):\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n backtrace (crc 0):\n pcpu_alloc_noprof+0x453/0xd80\n nft_counter_clone+0x9c/0x190 [nf_tables]\n nft_expr_clone+0x8f/0x1b0 [nf_tables]\n nft_dynset_new+0x2cb/0x5f0 [nf_tables]\n nft_rhash_update+0x236/0x11c0 [nf_tables]\n nft_dynset_eval+0x11f/0x670 [nf_tables]\n nft_do_chain+0x253/0x1700 [nf_tables]\n nft_do_chain_ipv4+0x18d/0x270 [nf_tables]\n nf_hook_slow+0xaa/0x1e0\n ip_local_deliver+0x209/0x330\n\nFixes: 563125a73ac3 (\"netfilter: nftables: generalize set extension to support for several expressions\")\nReported-by: Gurpreet Shergill <giki.shergill@proton.me>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Florian Westphal <fw@strlen.de>\n[ Minor conflict resolved. ]\nSigned-off-by: Li hongliang <1468888505@139.com>\n---\n include/net/netfilter/nf_tables.h | 2 ++\n net/netfilter/nf_tables_api.c | 4 ++--\n net/netfilter/nft_dynset.c | 10 +++++++++-\n 3 files changed, 13 insertions(+), 3 deletions(-)", "diff": "diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h\nindex 000ae2900f8c..ab0567951e31 100644\n--- a/include/net/netfilter/nf_tables.h\n+++ b/include/net/netfilter/nf_tables.h\n@@ -861,6 +861,8 @@ void *nft_set_elem_init(const struct nft_set *set,\n \t\t\tu64 timeout, u64 expiration, gfp_t gfp);\n int nft_set_elem_expr_clone(const struct nft_ctx *ctx, struct nft_set *set,\n \t\t\t struct nft_expr *expr_array[]);\n+void nft_set_elem_expr_destroy(const struct nft_ctx *ctx,\n+\t\t\t struct nft_set_elem_expr *elem_expr);\n void nft_set_elem_destroy(const struct nft_set *set, void *elem,\n \t\t\t bool destroy_expr);\n void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,\ndiff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c\nindex 0aaddc1131c6..a0914a92e07d 100644\n--- a/net/netfilter/nf_tables_api.c\n+++ b/net/netfilter/nf_tables_api.c\n@@ -6464,8 +6464,8 @@ static void __nft_set_elem_expr_destroy(const struct nft_ctx *ctx,\n \t}\n }\n \n-static void nft_set_elem_expr_destroy(const struct nft_ctx *ctx,\n-\t\t\t\t struct nft_set_elem_expr *elem_expr)\n+void nft_set_elem_expr_destroy(const struct nft_ctx *ctx,\n+\t\t\t struct nft_set_elem_expr *elem_expr)\n {\n \tstruct nft_expr *expr;\n \tu32 size;\ndiff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c\nindex 9a0aaeed2360..87c6a02675ba 100644\n--- a/net/netfilter/nft_dynset.c\n+++ b/net/netfilter/nft_dynset.c\n@@ -30,18 +30,26 @@ static int nft_dynset_expr_setup(const struct nft_dynset *priv,\n \t\t\t\t const struct nft_set_ext *ext)\n {\n \tstruct nft_set_elem_expr *elem_expr = nft_set_ext_expr(ext);\n+\tstruct nft_ctx ctx = {\n+\t\t.net\t= read_pnet(&priv->set->net),\n+\t\t.family\t= priv->set->table->family,\n+\t};\n \tstruct nft_expr *expr;\n \tint i;\n \n \tfor (i = 0; i < priv->num_exprs; i++) {\n \t\texpr = nft_setelem_expr_at(elem_expr, elem_expr->size);\n \t\tif (nft_expr_clone(expr, priv->expr_array[i], GFP_ATOMIC) < 0)\n-\t\t\treturn -1;\n+\t\t\tgoto err_out;\n \n \t\telem_expr->size += priv->expr_array[i]->ops->size;\n \t}\n \n \treturn 0;\n+err_out:\n+\tnft_set_elem_expr_destroy(&ctx, elem_expr);\n+\n+\treturn -1;\n }\n \n static void *nft_dynset_new(struct nft_set *set, const struct nft_expr *expr,\n", "prefixes": [ "6.6.y" ] }