Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/1.2/patches/2224269/?format=api
{ "id": 2224269, "url": "http://patchwork.ozlabs.org/api/1.2/patches/2224269/?format=api", "web_url": "http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260417082124.3253986-1-1468888505@139.com/", "project": { "id": 26, "url": "http://patchwork.ozlabs.org/api/1.2/projects/26/?format=api", "name": "Netfilter Development", "link_name": "netfilter-devel", "list_id": "netfilter-devel.vger.kernel.org", "list_email": "netfilter-devel@vger.kernel.org", "web_url": null, "scm_url": null, "webscm_url": null, "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<20260417082124.3253986-1-1468888505@139.com>", "list_archive_url": null, "date": "2026-04-17T08:21:24", "name": "[6.1.y] nf_tables: nft_dynset: fix possible stateful expression memleak in error path", "commit_ref": null, "pull_url": null, "state": "new", "archived": false, "hash": "8534fe2a3d3002e2a1bca18a76b07882ddb883bd", "submitter": { "id": 92514, "url": "http://patchwork.ozlabs.org/api/1.2/people/92514/?format=api", "name": "Li hongliang", "email": "1468888505@139.com" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260417082124.3253986-1-1468888505@139.com/mbox/", "series": [ { "id": 500271, "url": "http://patchwork.ozlabs.org/api/1.2/series/500271/?format=api", "web_url": "http://patchwork.ozlabs.org/project/netfilter-devel/list/?series=500271", "date": "2026-04-17T08:21:24", "name": "[6.1.y] nf_tables: nft_dynset: fix possible stateful expression memleak in error path", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/500271/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2224269/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2224269/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "\n <netfilter-devel+bounces-11986-incoming=patchwork.ozlabs.org@vger.kernel.org>", "X-Original-To": [ "incoming@patchwork.ozlabs.org", "netfilter-devel@vger.kernel.org" ], "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=pass (1024-bit key;\n unprotected) header.d=139.com header.i=@139.com header.a=rsa-sha256\n header.s=dkim header.b=EJEdDCci;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c04:e001:36c::12fc:5321; helo=tor.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-11986-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)", "smtp.subspace.kernel.org;\n\tdkim=pass (1024-bit key) header.d=139.com header.i=@139.com\n header.b=\"EJEdDCci\"", "smtp.subspace.kernel.org;\n arc=none smtp.client-ip=120.232.169.112", "smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=139.com", "smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=139.com" ], "Received": [ "from tor.lore.kernel.org (tor.lore.kernel.org\n [IPv6:2600:3c04:e001:36c::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fxp2c0ZvGz1yGt\n\tfor <incoming@patchwork.ozlabs.org>; Fri, 17 Apr 2026 18:29:28 +1000 (AEST)", "from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby tor.lore.kernel.org (Postfix) with ESMTP id E998431154D4\n\tfor <incoming@patchwork.ozlabs.org>; Fri, 17 Apr 2026 08:21:42 +0000 (UTC)", "from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id 5D2CE3A8750;\n\tFri, 17 Apr 2026 08:21:38 +0000 (UTC)", "from n169-112.mail.139.com (n169-112.mail.139.com [120.232.169.112])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id D7339361666;\n\tFri, 17 Apr 2026 08:21:34 +0000 (UTC)", "from NTT-kernel-dev (unknown[60.247.85.88])\n\tby rmsmtp-lg-appmail-19-12022 (RichMail) with SMTP id 2ef669e1ed8240b-00410;\n\tFri, 17 Apr 2026 16:21:25 +0800 (CST)" ], "ARC-Seal": "i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1776414097; cv=none;\n b=FH41HTGvodkDH2GVouBSAljt2SV01qkKXBkticatwMoKIu5dnFCc0PSdGySj/mR0fVYNcIM44fPCvJdctR1jn+gxoCvWoqRfM8Zy50jxtXXZ18SHYbj9TLhA+3Nt5TdMkKDqRWYEmXgLMjc1VChHA0U1jq/OuH9qaOlAJl2Tiro=", "ARC-Message-Signature": "i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1776414097; c=relaxed/simple;\n\tbh=LW+i+YA4Xwa7gsP0NIlf6qViFPK7ke20h2C1/t3Lgtg=;\n\th=From:To:Cc:Subject:Date:Message-Id:MIME-Version:Content-Type;\n b=q6m3ZbvPv40dLjgeXlk1q7RM/qYGH4JeyH6vl+L/CpZDVsN+7MEu7YCSF537s+lyji1x4b4CfeDTXZHQBqRf3sQkY7w+a0jw9JOiLasJDRSAYH0CwrtJgpC0ytsiFAjZIP6q2O7hclGU/yguhv448DueOSw2PinbVf00GTaQfEI=", "ARC-Authentication-Results": "i=1; smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=139.com;\n spf=pass smtp.mailfrom=139.com;\n dkim=pass (1024-bit key) header.d=139.com header.i=@139.com\n header.b=EJEdDCci; arc=none smtp.client-ip=120.232.169.112", "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=139.com; s=dkim; l=0;\n\th=from:subject:message-id:to:cc:mime-version;\n\tbh=47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=;\n\tb=EJEdDCci5Zq0PihilTDXlwECvfhn0jbZc3A7uVsYAWun8BjR+0BFaWsYiLvE5eWfHhbfJ55r9hRfh\n\t nfNGSv73//hcl981/LMAfy/RALv+wNq7RRxKBd39Gs+zTF8cvur8lrnjTfN2B3Ckcz6pr8Ynzb74WY\n\t Z9Zw+Z0QlFZU95wI=", "X-RM-TagInfo": "emlType=0 ", "X-RM-SPAM": "", "X-RM-SPAM-FLAG": "00000000", "X-RM-TRANSID": "2ef669e1ed8240b-00410", "From": "Li hongliang <1468888505@139.com>", "To": "gregkh@linuxfoundation.org,\n\tstable@vger.kernel.org,\n\tpablo@netfilter.org", "Cc": "patches@lists.linux.dev,\n\tlinux-kernel@vger.kernel.org,\n\tkadlec@netfilter.org,\n\tfw@strlen.de,\n\tdavem@davemloft.net,\n\tedumazet@google.com,\n\tkuba@kernel.org,\n\tpabeni@redhat.com,\n\tnetfilter-devel@vger.kernel.org,\n\tcoreteam@netfilter.org,\n\tnetdev@vger.kernel.org,\n\tgiki.shergill@proton.me", "Subject": "[PATCH 6.1.y] nf_tables: nft_dynset: fix possible stateful expression\n memleak in error path", "Date": "Fri, 17 Apr 2026 16:21:24 +0800", "Message-Id": "<20260417082124.3253986-1-1468888505@139.com>", "X-Mailer": "git-send-email 2.34.1", "Precedence": "bulk", "X-Mailing-List": "netfilter-devel@vger.kernel.org", "List-Id": "<netfilter-devel.vger.kernel.org>", "List-Subscribe": "<mailto:netfilter-devel+subscribe@vger.kernel.org>", "List-Unsubscribe": "<mailto:netfilter-devel+unsubscribe@vger.kernel.org>", "MIME-Version": "1.0", "Content-Type": "text/plain; charset=UTF-8", "Content-Transfer-Encoding": "8bit" }, "content": "From: Pablo Neira Ayuso <pablo@netfilter.org>\n\n[ Upstream commit 0548a13b5a145b16e4da0628b5936baf35f51b43 ]\n\nIf cloning the second stateful expression in the element via GFP_ATOMIC\nfails, then the first stateful expression remains in place without being\nreleased.\n\n unreferenced object (percpu) 0x607b97e9cab8 (size 16):\n comm \"softirq\", pid 0, jiffies 4294931867\n hex dump (first 16 bytes on cpu 3):\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n backtrace (crc 0):\n pcpu_alloc_noprof+0x453/0xd80\n nft_counter_clone+0x9c/0x190 [nf_tables]\n nft_expr_clone+0x8f/0x1b0 [nf_tables]\n nft_dynset_new+0x2cb/0x5f0 [nf_tables]\n nft_rhash_update+0x236/0x11c0 [nf_tables]\n nft_dynset_eval+0x11f/0x670 [nf_tables]\n nft_do_chain+0x253/0x1700 [nf_tables]\n nft_do_chain_ipv4+0x18d/0x270 [nf_tables]\n nf_hook_slow+0xaa/0x1e0\n ip_local_deliver+0x209/0x330\n\nFixes: 563125a73ac3 (\"netfilter: nftables: generalize set extension to support for several expressions\")\nReported-by: Gurpreet Shergill <giki.shergill@proton.me>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Florian Westphal <fw@strlen.de>\n[ Minor conflict resolved. ]\nSigned-off-by: Li hongliang <1468888505@139.com>\n---\n include/net/netfilter/nf_tables.h | 2 ++\n net/netfilter/nf_tables_api.c | 4 ++--\n net/netfilter/nft_dynset.c | 10 +++++++++-\n 3 files changed, 13 insertions(+), 3 deletions(-)", "diff": "diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h\nindex 38c74f9fcce2..dafa0a32e6e1 100644\n--- a/include/net/netfilter/nf_tables.h\n+++ b/include/net/netfilter/nf_tables.h\n@@ -838,6 +838,8 @@ void *nft_set_elem_init(const struct nft_set *set,\n \t\t\tu64 timeout, u64 expiration, gfp_t gfp);\n int nft_set_elem_expr_clone(const struct nft_ctx *ctx, struct nft_set *set,\n \t\t\t struct nft_expr *expr_array[]);\n+void nft_set_elem_expr_destroy(const struct nft_ctx *ctx,\n+\t\t\t struct nft_set_elem_expr *elem_expr);\n void nft_set_elem_destroy(const struct nft_set *set, void *elem,\n \t\t\t bool destroy_expr);\n void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,\ndiff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c\nindex fb3d529ebf5a..0c4224282638 100644\n--- a/net/netfilter/nf_tables_api.c\n+++ b/net/netfilter/nf_tables_api.c\n@@ -6025,8 +6025,8 @@ static void __nft_set_elem_expr_destroy(const struct nft_ctx *ctx,\n \t}\n }\n \n-static void nft_set_elem_expr_destroy(const struct nft_ctx *ctx,\n-\t\t\t\t struct nft_set_elem_expr *elem_expr)\n+void nft_set_elem_expr_destroy(const struct nft_ctx *ctx,\n+\t\t\t struct nft_set_elem_expr *elem_expr)\n {\n \tstruct nft_expr *expr;\n \tu32 size;\ndiff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c\nindex 953aba871f45..5f58ac874005 100644\n--- a/net/netfilter/nft_dynset.c\n+++ b/net/netfilter/nft_dynset.c\n@@ -30,18 +30,26 @@ static int nft_dynset_expr_setup(const struct nft_dynset *priv,\n \t\t\t\t const struct nft_set_ext *ext)\n {\n \tstruct nft_set_elem_expr *elem_expr = nft_set_ext_expr(ext);\n+\tstruct nft_ctx ctx = {\n+\t\t.net\t= read_pnet(&priv->set->net),\n+\t\t.family\t= priv->set->table->family,\n+\t};\n \tstruct nft_expr *expr;\n \tint i;\n \n \tfor (i = 0; i < priv->num_exprs; i++) {\n \t\texpr = nft_setelem_expr_at(elem_expr, elem_expr->size);\n \t\tif (nft_expr_clone(expr, priv->expr_array[i], GFP_ATOMIC) < 0)\n-\t\t\treturn -1;\n+\t\t\tgoto err_out;\n \n \t\telem_expr->size += priv->expr_array[i]->ops->size;\n \t}\n \n \treturn 0;\n+err_out:\n+\tnft_set_elem_expr_destroy(&ctx, elem_expr);\n+\n+\treturn -1;\n }\n \n static void *nft_dynset_new(struct nft_set *set, const struct nft_expr *expr,\n", "prefixes": [ "6.1.y" ] }