Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/1.2/patches/2224272/?format=api
{ "id": 2224272, "url": "http://patchwork.ozlabs.org/api/1.2/patches/2224272/?format=api", "web_url": "http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260417082242.3254196-1-1468888505@139.com/", "project": { "id": 26, "url": "http://patchwork.ozlabs.org/api/1.2/projects/26/?format=api", "name": "Netfilter Development", "link_name": "netfilter-devel", "list_id": "netfilter-devel.vger.kernel.org", "list_email": "netfilter-devel@vger.kernel.org", "web_url": null, "scm_url": null, "webscm_url": null, "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<20260417082242.3254196-1-1468888505@139.com>", "list_archive_url": null, "date": "2026-04-17T08:22:42", "name": "[5.15.y] nf_tables: nft_dynset: fix possible stateful expression memleak in error path", "commit_ref": null, "pull_url": null, "state": "new", "archived": false, "hash": "8534fe2a3d3002e2a1bca18a76b07882ddb883bd", "submitter": { "id": 92514, "url": "http://patchwork.ozlabs.org/api/1.2/people/92514/?format=api", "name": "Li hongliang", "email": "1468888505@139.com" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260417082242.3254196-1-1468888505@139.com/mbox/", "series": [ { "id": 500274, "url": "http://patchwork.ozlabs.org/api/1.2/series/500274/?format=api", "web_url": "http://patchwork.ozlabs.org/project/netfilter-devel/list/?series=500274", "date": "2026-04-17T08:22:42", "name": "[5.15.y] nf_tables: nft_dynset: fix possible stateful expression memleak in error path", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/500274/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2224272/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2224272/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "\n <netfilter-devel+bounces-11987-incoming=patchwork.ozlabs.org@vger.kernel.org>", "X-Original-To": [ "incoming@patchwork.ozlabs.org", "netfilter-devel@vger.kernel.org" ], "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=pass (1024-bit key;\n unprotected) header.d=139.com header.i=@139.com header.a=rsa-sha256\n header.s=dkim header.b=zwEg4qUI;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c15:e001:75::12fc:5321; helo=sin.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-11987-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)", "smtp.subspace.kernel.org;\n\tdkim=pass (1024-bit key) header.d=139.com header.i=@139.com\n header.b=\"zwEg4qUI\"", "smtp.subspace.kernel.org;\n arc=none smtp.client-ip=120.232.169.113", "smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=139.com", "smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=139.com" ], "Received": [ "from sin.lore.kernel.org (sin.lore.kernel.org\n [IPv6:2600:3c15:e001:75::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fxp4x1dKZz1yD3\n\tfor <incoming@patchwork.ozlabs.org>; Fri, 17 Apr 2026 18:31:29 +1000 (AEST)", "from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sin.lore.kernel.org (Postfix) with ESMTP id 017F03049E38\n\tfor <incoming@patchwork.ozlabs.org>; Fri, 17 Apr 2026 08:23:03 +0000 (UTC)", "from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id CCB143AA4E7;\n\tFri, 17 Apr 2026 08:22:57 +0000 (UTC)", "from n169-113.mail.139.com (n169-113.mail.139.com [120.232.169.113])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id DD0C63A9DA1;\n\tFri, 17 Apr 2026 08:22:53 +0000 (UTC)", "from NTT-kernel-dev (unknown[60.247.85.88])\n\tby rmsmtp-lg-appmail-31-12045 (RichMail) with SMTP id 2f0d69e1edd2a2b-01a4b;\n\tFri, 17 Apr 2026 16:22:43 +0800 (CST)" ], "ARC-Seal": "i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1776414177; cv=none;\n b=HQ/l32N/Lx7zRVnHknPsLBtGwtwb2+mFufruXR9MTTe2qrV6Bu2ZEFa32gIz/GGQesTJZnQ8l9VitzNz53ppF3qsq31+CLo/c+fqTayByZ+50hZ1GI6mRr4zT3JA6c/UzOQFbdyxsg+/96u/BTaV5DIqk7O9+hKQ01Qwkzgjq6E=", "ARC-Message-Signature": "i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1776414177; c=relaxed/simple;\n\tbh=KyWH9WrRsB7SfQ2c73Pw9DmEu/wFTMyZukemJdiPTF8=;\n\th=From:To:Cc:Subject:Date:Message-Id:MIME-Version:Content-Type;\n b=btP8lvsbJhc3tbeG54Iq6lIkTuMztUaYxOssWFQ0jda76uJ+B2xuyLdw1XSGsk+q5ttdS1mQWq9eEZx3Xp3NKAs+hEiRyv5mB5pFqer9y4ErKYrzY5Ov9oHoETW6rN0/WOUGgmhNHMwwQR/9lK7tIpB4ZotWQC2lOigvP+6aAa0=", "ARC-Authentication-Results": "i=1; smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=139.com;\n spf=pass smtp.mailfrom=139.com;\n dkim=pass (1024-bit key) header.d=139.com header.i=@139.com\n header.b=zwEg4qUI; arc=none smtp.client-ip=120.232.169.113", "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=139.com; s=dkim; l=0;\n\th=from:subject:message-id:to:cc:mime-version;\n\tbh=47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=;\n\tb=zwEg4qUIg1/tGPzrrQpOcDk59QqrIlaIwRV2jQN4W10McLBhudDx5/qYLqomtWKfPVKTXqRTAMc/p\n\t 0m0LK0/7YB5pLsZ5Mv11wRQo47KEIovjv764k3aG6CORfNS5scu2JDHnp3dnnU8NXwSpK6IfJuPbaU\n\t uAyIz9omibA+HLTE=", "X-RM-TagInfo": "emlType=0 ", "X-RM-SPAM": "", "X-RM-SPAM-FLAG": "00000000", "X-RM-TRANSID": "2f0d69e1edd2a2b-01a4b", "From": "Li hongliang <1468888505@139.com>", "To": "gregkh@linuxfoundation.org,\n\tstable@vger.kernel.org,\n\tpablo@netfilter.org", "Cc": "patches@lists.linux.dev,\n\tlinux-kernel@vger.kernel.org,\n\tkadlec@netfilter.org,\n\tfw@strlen.de,\n\tdavem@davemloft.net,\n\tedumazet@google.com,\n\tkuba@kernel.org,\n\tpabeni@redhat.com,\n\tnetfilter-devel@vger.kernel.org,\n\tcoreteam@netfilter.org,\n\tnetdev@vger.kernel.org,\n\tgiki.shergill@proton.me", "Subject": "[PATCH 5.15.y] nf_tables: nft_dynset: fix possible stateful\n expression memleak in error path", "Date": "Fri, 17 Apr 2026 16:22:42 +0800", "Message-Id": "<20260417082242.3254196-1-1468888505@139.com>", "X-Mailer": "git-send-email 2.34.1", "Precedence": "bulk", "X-Mailing-List": "netfilter-devel@vger.kernel.org", "List-Id": "<netfilter-devel.vger.kernel.org>", "List-Subscribe": "<mailto:netfilter-devel+subscribe@vger.kernel.org>", "List-Unsubscribe": "<mailto:netfilter-devel+unsubscribe@vger.kernel.org>", "MIME-Version": "1.0", "Content-Type": "text/plain; charset=UTF-8", "Content-Transfer-Encoding": "8bit" }, "content": "From: Pablo Neira Ayuso <pablo@netfilter.org>\n\n[ Upstream commit 0548a13b5a145b16e4da0628b5936baf35f51b43 ]\n\nIf cloning the second stateful expression in the element via GFP_ATOMIC\nfails, then the first stateful expression remains in place without being\nreleased.\n\n unreferenced object (percpu) 0x607b97e9cab8 (size 16):\n comm \"softirq\", pid 0, jiffies 4294931867\n hex dump (first 16 bytes on cpu 3):\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n backtrace (crc 0):\n pcpu_alloc_noprof+0x453/0xd80\n nft_counter_clone+0x9c/0x190 [nf_tables]\n nft_expr_clone+0x8f/0x1b0 [nf_tables]\n nft_dynset_new+0x2cb/0x5f0 [nf_tables]\n nft_rhash_update+0x236/0x11c0 [nf_tables]\n nft_dynset_eval+0x11f/0x670 [nf_tables]\n nft_do_chain+0x253/0x1700 [nf_tables]\n nft_do_chain_ipv4+0x18d/0x270 [nf_tables]\n nf_hook_slow+0xaa/0x1e0\n ip_local_deliver+0x209/0x330\n\nFixes: 563125a73ac3 (\"netfilter: nftables: generalize set extension to support for several expressions\")\nReported-by: Gurpreet Shergill <giki.shergill@proton.me>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Florian Westphal <fw@strlen.de>\n[ Minor conflict resolved. ]\nSigned-off-by: Li hongliang <1468888505@139.com>\n---\n include/net/netfilter/nf_tables.h | 2 ++\n net/netfilter/nf_tables_api.c | 4 ++--\n net/netfilter/nft_dynset.c | 10 +++++++++-\n 3 files changed, 13 insertions(+), 3 deletions(-)", "diff": "diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h\nindex 605d4c0a63e9..1f805590b838 100644\n--- a/include/net/netfilter/nf_tables.h\n+++ b/include/net/netfilter/nf_tables.h\n@@ -821,6 +821,8 @@ void *nft_set_elem_init(const struct nft_set *set,\n \t\t\tu64 timeout, u64 expiration, gfp_t gfp);\n int nft_set_elem_expr_clone(const struct nft_ctx *ctx, struct nft_set *set,\n \t\t\t struct nft_expr *expr_array[]);\n+void nft_set_elem_expr_destroy(const struct nft_ctx *ctx,\n+\t\t\t struct nft_set_elem_expr *elem_expr);\n void nft_set_elem_destroy(const struct nft_set *set, void *elem,\n \t\t\t bool destroy_expr);\n void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,\ndiff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c\nindex cbec5fc23719..b78949933acf 100644\n--- a/net/netfilter/nf_tables_api.c\n+++ b/net/netfilter/nf_tables_api.c\n@@ -5919,8 +5919,8 @@ static void __nft_set_elem_expr_destroy(const struct nft_ctx *ctx,\n \t}\n }\n \n-static void nft_set_elem_expr_destroy(const struct nft_ctx *ctx,\n-\t\t\t\t struct nft_set_elem_expr *elem_expr)\n+void nft_set_elem_expr_destroy(const struct nft_ctx *ctx,\n+\t\t\t struct nft_set_elem_expr *elem_expr)\n {\n \tstruct nft_expr *expr;\n \tu32 size;\ndiff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c\nindex ecdd4a60db9c..673c5e6a3e8d 100644\n--- a/net/netfilter/nft_dynset.c\n+++ b/net/netfilter/nft_dynset.c\n@@ -30,18 +30,26 @@ static int nft_dynset_expr_setup(const struct nft_dynset *priv,\n \t\t\t\t const struct nft_set_ext *ext)\n {\n \tstruct nft_set_elem_expr *elem_expr = nft_set_ext_expr(ext);\n+\tstruct nft_ctx ctx = {\n+\t\t.net\t= read_pnet(&priv->set->net),\n+\t\t.family\t= priv->set->table->family,\n+\t};\n \tstruct nft_expr *expr;\n \tint i;\n \n \tfor (i = 0; i < priv->num_exprs; i++) {\n \t\texpr = nft_setelem_expr_at(elem_expr, elem_expr->size);\n \t\tif (nft_expr_clone(expr, priv->expr_array[i], GFP_ATOMIC) < 0)\n-\t\t\treturn -1;\n+\t\t\tgoto err_out;\n \n \t\telem_expr->size += priv->expr_array[i]->ops->size;\n \t}\n \n \treturn 0;\n+err_out:\n+\tnft_set_elem_expr_destroy(&ctx, elem_expr);\n+\n+\treturn -1;\n }\n \n static void *nft_dynset_new(struct nft_set *set, const struct nft_expr *expr,\n", "prefixes": [ "5.15.y" ] }