diff options
| author | Pablo Neira Ayuso | 2012-04-03 16:45:54 +0200 |
|---|---|---|
| committer | David S. Miller | 2012-04-04 01:20:30 +0200 |
| commit | d96fc659aeb27686cef42d305cfd0c9702f8841c (patch) | |
| tree | e021455bc7c25a1dfc80360b05caf5bc55dc68ae /net | |
| parent | netfilter: xt_CT: fix missing put timeout object in error path (diff) | |
| download | kernel-qcow2-linux-d96fc659aeb27686cef42d305cfd0c9702f8841c.tar.gz kernel-qcow2-linux-d96fc659aeb27686cef42d305cfd0c9702f8841c.tar.xz kernel-qcow2-linux-d96fc659aeb27686cef42d305cfd0c9702f8841c.zip | |
netfilter: nf_conntrack: fix count leak in error path of __nf_conntrack_alloc
We have to decrement the conntrack counter if we fail to access the
zone extension.
Reported-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
| -rw-r--r-- | net/netfilter/nf_conntrack_core.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c index cbdb754dbb10..3cc4487ac349 100644 --- a/net/netfilter/nf_conntrack_core.c +++ b/net/netfilter/nf_conntrack_core.c @@ -735,6 +735,7 @@ __nf_conntrack_alloc(struct net *net, u16 zone, #ifdef CONFIG_NF_CONNTRACK_ZONES out_free: + atomic_dec(&net->ct.count); kmem_cache_free(net->ct.nf_conntrack_cachep, ct); return ERR_PTR(-ENOMEM); #endif |