netfilter: xt_CT: fix missing put timeout object in error path

The error path misses putting the timeout object. This patch adds
new function xt_ct_tg_timeout_put() to put the timeout object.

Reported-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 19 insertions, 5 deletions

diff --git a/net/netfilter/xt_CT.c b/net/netfilter/xt_CT.c
index 4babb278e41e..59530e93fa58 100644
--- a/net/netfilter/xt_CT.c
+++ b/net/netfilter/xt_CT.c
@@ -150,6 +150,17 @@ err1:
         return ret;
 }
 
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
+static void __xt_ct_tg_timeout_put(struct ctnl_timeout *timeout)
+{
+        typeof(nf_ct_timeout_put_hook) timeout_put;
+
+        timeout_put = rcu_dereference(nf_ct_timeout_put_hook);
+        if (timeout_put)
+                timeout_put(timeout);
+}
+#endif
+
 static int xt_ct_tg_check_v1(const struct xt_tgchk_param *par)
 {
         struct xt_ct_target_info_v1 *info = par->targinfo;
@@ -158,7 +169,9 @@ static int xt_ct_tg_check_v1(const struct xt_tgchk_param *par)
         struct nf_conn *ct;
         int ret = 0;
         u8 proto;
-
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
+        struct ctnl_timeout *timeout;
+#endif
         if (info->flags & ~XT_CT_NOTRACK)
                 return -EINVAL;
 
@@ -216,7 +229,6 @@ static int xt_ct_tg_check_v1(const struct xt_tgchk_param *par)
 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
         if (info->timeout) {
                 typeof(nf_ct_timeout_find_get_hook) timeout_find_get;
-                struct ctnl_timeout *timeout;
                 struct nf_conn_timeout *timeout_ext;
 
                 rcu_read_lock();
@@ -245,7 +257,7 @@ static int xt_ct_tg_check_v1(const struct xt_tgchk_param *par)
                                 pr_info("Timeout policy `%s' can only be "
                                         "used by L3 protocol number %d\n",
                                         info->timeout, timeout->l3num);
-                                goto err4;
+                                goto err5;
                         }
                         /* Make sure the timeout policy matches any existing
                          * protocol tracker, otherwise default to generic.
@@ -258,13 +270,13 @@ static int xt_ct_tg_check_v1(const struct xt_tgchk_param *par)
                                         "used by L4 protocol number %d\n",
                                         info->timeout,
                                         timeout->l4proto->l4proto);
-                                goto err4;
+                                goto err5;
                         }
                         timeout_ext = nf_ct_timeout_ext_add(ct, timeout,
                                                             GFP_ATOMIC);
                         if (timeout_ext == NULL) {
                                 ret = -ENOMEM;
-                                goto err4;
+                                goto err5;
                         }
                 } else {
                         ret = -ENOENT;
@@ -282,6 +294,8 @@ out:
         return 0;
 
 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
+err5:
+        __xt_ct_tg_timeout_put(timeout);
 err4:
         rcu_read_unlock();
 #endif