netfilter: nf_tables: release flow rule object from commit path
authorPablo Neira Ayuso <pablo@netfilter.org>
Wed, 26 Oct 2022 07:54:45 +0000 (09:54 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 10 Nov 2022 17:15:28 +0000 (18:15 +0100)
commit6044791b7be707fd0e709f26e961a446424e5051
tree2346d73b010ccffe83337eb8d7447c3ccce5e56b
parent1ffe7100411a8b9015115ce124cd6c9c9da6f8e3
netfilter: nf_tables: release flow rule object from commit path

[ Upstream commit 26b5934ff4194e13196bedcba373cd4915071d0e ]

No need to postpone this to the commit release path, since no packets
are walking over this object, this is accessed from control plane only.
This helped uncovered UAF triggered by races with the netlink notifier.

Fixes: 9dd732e0bdf5 ("netfilter: nf_tables: memleak flow rule from commit path")
Reported-by: syzbot+8f747f62763bc6c32916@syzkaller.appspotmail.com
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
net/netfilter/nf_tables_api.c