{"id":2224269,"url":"http://patchwork.ozlabs.org/api/1.2/patches/2224269/?format=json","web_url":"http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260417082124.3253986-1-1468888505@139.com/","project":{"id":26,"url":"http://patchwork.ozlabs.org/api/1.2/projects/26/?format=json","name":"Netfilter Development","link_name":"netfilter-devel","list_id":"netfilter-devel.vger.kernel.org","list_email":"netfilter-devel@vger.kernel.org","web_url":null,"scm_url":null,"webscm_url":null,"list_archive_url":"","list_archive_url_format":"","commit_url_format":""},"msgid":"<20260417082124.3253986-1-1468888505@139.com>","list_archive_url":null,"date":"2026-04-17T08:21:24","name":"[6.1.y] nf_tables: nft_dynset: fix possible stateful expression memleak in error path","commit_ref":null,"pull_url":null,"state":"new","archived":false,"hash":"8534fe2a3d3002e2a1bca18a76b07882ddb883bd","submitter":{"id":92514,"url":"http://patchwork.ozlabs.org/api/1.2/people/92514/?format=json","name":"Li hongliang","email":"1468888505@139.com"},"delegate":null,"mbox":"http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260417082124.3253986-1-1468888505@139.com/mbox/","series":[{"id":500271,"url":"http://patchwork.ozlabs.org/api/1.2/series/500271/?format=json","web_url":"http://patchwork.ozlabs.org/project/netfilter-devel/list/?series=500271","date":"2026-04-17T08:21:24","name":"[6.1.y] nf_tables: nft_dynset: fix possible stateful expression memleak in error path","version":1,"mbox":"http://patchwork.ozlabs.org/series/500271/mbox/"}],"comments":"http://patchwork.ozlabs.org/api/patches/2224269/comments/","check":"pending","checks":"http://patchwork.ozlabs.org/api/patches/2224269/checks/","tags":{},"related":[],"headers":{"Return-Path":"\n ","X-Original-To":["incoming@patchwork.ozlabs.org","netfilter-devel@vger.kernel.org"],"Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (1024-bit key;\n unprotected) header.d=139.com header.i=@139.com header.a=rsa-sha256\n header.s=dkim header.b=EJEdDCci;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c04:e001:36c::12fc:5321; helo=tor.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-11986-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)","smtp.subspace.kernel.org;\n\tdkim=pass (1024-bit key) header.d=139.com header.i=@139.com\n header.b=\"EJEdDCci\"","smtp.subspace.kernel.org;\n arc=none smtp.client-ip=120.232.169.112","smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=139.com","smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=139.com"],"Received":["from tor.lore.kernel.org (tor.lore.kernel.org\n [IPv6:2600:3c04:e001:36c::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fxp2c0ZvGz1yGt\n\tfor ; Fri, 17 Apr 2026 18:29:28 +1000 (AEST)","from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby tor.lore.kernel.org (Postfix) with ESMTP id E998431154D4\n\tfor ; Fri, 17 Apr 2026 08:21:42 +0000 (UTC)","from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id 5D2CE3A8750;\n\tFri, 17 Apr 2026 08:21:38 +0000 (UTC)","from n169-112.mail.139.com (n169-112.mail.139.com [120.232.169.112])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id D7339361666;\n\tFri, 17 Apr 2026 08:21:34 +0000 (UTC)","from NTT-kernel-dev (unknown[60.247.85.88])\n\tby rmsmtp-lg-appmail-19-12022 (RichMail) with SMTP id 2ef669e1ed8240b-00410;\n\tFri, 17 Apr 2026 16:21:25 +0800 (CST)"],"ARC-Seal":"i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1776414097; cv=none;\n b=FH41HTGvodkDH2GVouBSAljt2SV01qkKXBkticatwMoKIu5dnFCc0PSdGySj/mR0fVYNcIM44fPCvJdctR1jn+gxoCvWoqRfM8Zy50jxtXXZ18SHYbj9TLhA+3Nt5TdMkKDqRWYEmXgLMjc1VChHA0U1jq/OuH9qaOlAJl2Tiro=","ARC-Message-Signature":"i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1776414097; c=relaxed/simple;\n\tbh=LW+i+YA4Xwa7gsP0NIlf6qViFPK7ke20h2C1/t3Lgtg=;\n\th=From:To:Cc:Subject:Date:Message-Id:MIME-Version:Content-Type;\n b=q6m3ZbvPv40dLjgeXlk1q7RM/qYGH4JeyH6vl+L/CpZDVsN+7MEu7YCSF537s+lyji1x4b4CfeDTXZHQBqRf3sQkY7w+a0jw9JOiLasJDRSAYH0CwrtJgpC0ytsiFAjZIP6q2O7hclGU/yguhv448DueOSw2PinbVf00GTaQfEI=","ARC-Authentication-Results":"i=1; smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=139.com;\n spf=pass smtp.mailfrom=139.com;\n dkim=pass (1024-bit key) header.d=139.com header.i=@139.com\n header.b=EJEdDCci; arc=none smtp.client-ip=120.232.169.112","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=139.com; s=dkim; l=0;\n\th=from:subject:message-id:to:cc:mime-version;\n\tbh=47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=;\n\tb=EJEdDCci5Zq0PihilTDXlwECvfhn0jbZc3A7uVsYAWun8BjR+0BFaWsYiLvE5eWfHhbfJ55r9hRfh\n\t nfNGSv73//hcl981/LMAfy/RALv+wNq7RRxKBd39Gs+zTF8cvur8lrnjTfN2B3Ckcz6pr8Ynzb74WY\n\t Z9Zw+Z0QlFZU95wI=","X-RM-TagInfo":"emlType=0 ","X-RM-SPAM":"","X-RM-SPAM-FLAG":"00000000","X-RM-TRANSID":"2ef669e1ed8240b-00410","From":"Li hongliang <1468888505@139.com>","To":"gregkh@linuxfoundation.org,\n\tstable@vger.kernel.org,\n\tpablo@netfilter.org","Cc":"patches@lists.linux.dev,\n\tlinux-kernel@vger.kernel.org,\n\tkadlec@netfilter.org,\n\tfw@strlen.de,\n\tdavem@davemloft.net,\n\tedumazet@google.com,\n\tkuba@kernel.org,\n\tpabeni@redhat.com,\n\tnetfilter-devel@vger.kernel.org,\n\tcoreteam@netfilter.org,\n\tnetdev@vger.kernel.org,\n\tgiki.shergill@proton.me","Subject":"[PATCH 6.1.y] nf_tables: nft_dynset: fix possible stateful expression\n memleak in error path","Date":"Fri, 17 Apr 2026 16:21:24 +0800","Message-Id":"<20260417082124.3253986-1-1468888505@139.com>","X-Mailer":"git-send-email 2.34.1","Precedence":"bulk","X-Mailing-List":"netfilter-devel@vger.kernel.org","List-Id":"","List-Subscribe":"","List-Unsubscribe":"","MIME-Version":"1.0","Content-Type":"text/plain; charset=UTF-8","Content-Transfer-Encoding":"8bit"},"content":"From: Pablo Neira Ayuso \n\n[ Upstream commit 0548a13b5a145b16e4da0628b5936baf35f51b43 ]\n\nIf cloning the second stateful expression in the element via GFP_ATOMIC\nfails, then the first stateful expression remains in place without being\nreleased.\n\n   unreferenced object (percpu) 0x607b97e9cab8 (size 16):\n     comm \"softirq\", pid 0, jiffies 4294931867\n     hex dump (first 16 bytes on cpu 3):\n       00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n     backtrace (crc 0):\n       pcpu_alloc_noprof+0x453/0xd80\n       nft_counter_clone+0x9c/0x190 [nf_tables]\n       nft_expr_clone+0x8f/0x1b0 [nf_tables]\n       nft_dynset_new+0x2cb/0x5f0 [nf_tables]\n       nft_rhash_update+0x236/0x11c0 [nf_tables]\n       nft_dynset_eval+0x11f/0x670 [nf_tables]\n       nft_do_chain+0x253/0x1700 [nf_tables]\n       nft_do_chain_ipv4+0x18d/0x270 [nf_tables]\n       nf_hook_slow+0xaa/0x1e0\n       ip_local_deliver+0x209/0x330\n\nFixes: 563125a73ac3 (\"netfilter: nftables: generalize set extension to support for several expressions\")\nReported-by: Gurpreet Shergill \nSigned-off-by: Pablo Neira Ayuso \nSigned-off-by: Florian Westphal \n[ Minor conflict resolved. ]\nSigned-off-by: Li hongliang <1468888505@139.com>\n---\n include/net/netfilter/nf_tables.h | 2 ++\n net/netfilter/nf_tables_api.c | 4 ++--\n net/netfilter/nft_dynset.c | 10 +++++++++-\n 3 files changed, 13 insertions(+), 3 deletions(-)","diff":"diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h\nindex 38c74f9fcce2..dafa0a32e6e1 100644\n--- a/include/net/netfilter/nf_tables.h\n+++ b/include/net/netfilter/nf_tables.h\n@@ -838,6 +838,8 @@ void *nft_set_elem_init(const struct nft_set *set,\n \t\t\tu64 timeout, u64 expiration, gfp_t gfp);\n int nft_set_elem_expr_clone(const struct nft_ctx *ctx, struct nft_set *set,\n \t\t\t struct nft_expr *expr_array[]);\n+void nft_set_elem_expr_destroy(const struct nft_ctx *ctx,\n+\t\t\t struct nft_set_elem_expr *elem_expr);\n void nft_set_elem_destroy(const struct nft_set *set, void *elem,\n \t\t\t bool destroy_expr);\n void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,\ndiff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c\nindex fb3d529ebf5a..0c4224282638 100644\n--- a/net/netfilter/nf_tables_api.c\n+++ b/net/netfilter/nf_tables_api.c\n@@ -6025,8 +6025,8 @@ static void __nft_set_elem_expr_destroy(const struct nft_ctx *ctx,\n \t}\n }\n \n-static void nft_set_elem_expr_destroy(const struct nft_ctx *ctx,\n-\t\t\t\t struct nft_set_elem_expr *elem_expr)\n+void nft_set_elem_expr_destroy(const struct nft_ctx *ctx,\n+\t\t\t struct nft_set_elem_expr *elem_expr)\n {\n \tstruct nft_expr *expr;\n \tu32 size;\ndiff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c\nindex 953aba871f45..5f58ac874005 100644\n--- a/net/netfilter/nft_dynset.c\n+++ b/net/netfilter/nft_dynset.c\n@@ -30,18 +30,26 @@ static int nft_dynset_expr_setup(const struct nft_dynset *priv,\n \t\t\t\t const struct nft_set_ext *ext)\n {\n \tstruct nft_set_elem_expr *elem_expr = nft_set_ext_expr(ext);\n+\tstruct nft_ctx ctx = {\n+\t\t.net\t= read_pnet(&priv->set->net),\n+\t\t.family\t= priv->set->table->family,\n+\t};\n \tstruct nft_expr *expr;\n \tint i;\n \n \tfor (i = 0; i < priv->num_exprs; i++) {\n \t\texpr = nft_setelem_expr_at(elem_expr, elem_expr->size);\n \t\tif (nft_expr_clone(expr, priv->expr_array[i], GFP_ATOMIC) < 0)\n-\t\t\treturn -1;\n+\t\t\tgoto err_out;\n \n \t\telem_expr->size += priv->expr_array[i]->ops->size;\n \t}\n \n \treturn 0;\n+err_out:\n+\tnft_set_elem_expr_destroy(&ctx, elem_expr);\n+\n+\treturn -1;\n }\n \n static void *nft_dynset_new(struct nft_set *set, const struct nft_expr *expr,\n","prefixes":["6.1.y"]}