From:   Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
To:     Pablo Neira Ayuso <pablo@netfilter.org>,
        Jozsef Kadlecsik <kadlec@netfilter.org>,
        Florian Westphal <fw@strlen.de>
Cc:     netfilter-devel@vger.kernel.org, coreteam@netfilter.org,
        netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
        kernel@openvz.org, Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
Subject: [PATCH] netfilter: fix percpu counter block leak on error path when creating new netns
Date:   Mon, 13 Feb 2023 12:25:05 +0800
Message-Id: <20230213042505.334898-1-ptikhomirov@virtuozzo.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?B0pmKAStwff5AHg4RWiB0aXsz9zuQ252i6+SNZygQz73lH30GbeGhMHocBeM?=
 =?us-ascii?Q?Lv/exc6oLU2SCrQ0RiHFTiD7A9UEfitCd5liamepaCrb/ddvrd6DcYyyeQ1L?=
 =?us-ascii?Q?YLKZh2HHA+bkBSI1ZpOiW7Itt//neOJYCl1UFTexEmBGX/XP4Ln0vhb+WyHt?=
 =?us-ascii?Q?amUJwP85FxBkYvz7B9lrY7Kmag1ihgN6P4G+dzUopBE3drygK9eWtxw/C0Nl?=
 =?us-ascii?Q?o2v74X5E3hNYBLO3mDlrlb4UOHMM1OJ53Lq2jaVuCeR3WqS6D8Jkhd3u2lsO?=
 =?us-ascii?Q?V03CERv5NVRkQmRlRE/Kq6OrKB4UGe7oGAjnwORw9f+8ZJ1NOFQH35lksWbG?=
 =?us-ascii?Q?iSUGMJ1tgR6opz5B3kJUg6ULhzaQS+4NrTrbWmx1Gma7KbuETLpo8g54ldbY?=
 =?us-ascii?Q?CibU6EWdJ5kYpgLd07hWgezHDFckRbEjgZu0GqbpATzRdpmP+yosIMfIE2VA?=
 =?us-ascii?Q?tx6xOtqSgLeXWmHWUNBtA9mTmMZpf27gKyh6P+RUZjy69NEs+uyixPAjbTx0?=
 =?us-ascii?Q?k26+dMQsei2q8ZRV4olSAA6D7sjyztxqGbkfdK/QJu85o+rzf+o+b62MdOWn?=
 =?us-ascii?Q?/FyCn6iQCiGUi41HkGJ1CpyNafi6KEIjvCHd7lRBnlWwSsJayt/SrQxeLuYu?=
 =?us-ascii?Q?T0cGHy4/Zoc0Gv5XsKFxUKNf1o7XOI72mpUpoQmRqEftRzi8mHUGszD4kl8f?=
 =?us-ascii?Q?c08O+VP4t5OhWYWztQSCygVJb96gQCLgNfR2v03/GTrAPE252Nx0tdQ2Sy8H?=
 =?us-ascii?Q?2Xs6PFgTSU3S17fn4gTBr6ltxW4BstJVb7jMmskb62RcmzOxvTWyxmP0qC3c?=
 =?us-ascii?Q?cr3ROcQFIFiJ9x6jFpcSnILWKUk1mKuyt0SSgMwHvd4Zvb/nugfgc0yds97P?=
 =?us-ascii?Q?AakocGpVSDoMZwQdqfgvxVNthGCfQj7NmkEchhAClO+tWoefngzom6eWqYqE?=
 =?us-ascii?Q?Barf60mDj1EV9KBSrgq6pI/EcQ6bgi9dwURunRG4/tqU9+KUKBWI4WbNUgjD?=
 =?us-ascii?Q?ZdEIaqmtMUpOtnCaC0yxbwMn6cLRI1xqiCtKNBIrL1uGQ67Sv4VC9sSFi0A6?=
 =?us-ascii?Q?Rf08uC21B7DWM3vlk6iSBzbUx7c5RzWcv6UreoZZ3geoMQrO5Oj7a9Bjq8pW?=
 =?us-ascii?Q?tRbJUvnbZUfo2nQsSFM6xUyPRsVf2JDr7g500BgOVUcXDAh58FBDLGQKRrw+?=
 =?us-ascii?Q?coufUbbUOjPju3Td7sHLdtRijDK69+h/8ACbIgDlJuZwDGnoFKaLDfGpPBYw?=
 =?us-ascii?Q?XNvWIdwnM4eMbm/tDcbaHv9JF2eMSjeKGw1GYr0E5v2pL/nJ4xjXRjuZ50Eg?=
 =?us-ascii?Q?D4COWA2E1KM6AGHswMn5AsNvKcODaGAEflMRv3kBUW3JR0ELSJ2JtH8piLeW?=
 =?us-ascii?Q?Ytq4mf6v3hJT7Oc8SSvimfr3JSbNheByrtH0pg9T9PwDW2f6MAHHZWFX1/lv?=
 =?us-ascii?Q?pWl+hDB1WnjBse+peY2xa0fjmLWdJt3pQFz7X0P6PY7AfsawqwWROH5p4AqG?=
 =?us-ascii?Q?p3czJW+SbLnLOdH+MWZokajS6VGww9SoLNlENnS/j9om5aVJXLDB7bkAgjcP?=
 =?us-ascii?Q?uUGqXrCiFmoTg6AJPVTpBkRh+UPO19p8IG1dcn+f9K+KQDzQmhTwXNQEynkz?=
 =?us-ascii?Q?mSHFbtmdUb+iDf0k7y/lMvnTKTBa1u3Xc9SnSN1z/ZfBH9V+VtbKw3OcQYV0?=
 =?us-ascii?Q?g1CU9Q=3D=3D?=
X-OriginatorOrg: virtuozzo.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 57a453c6-1d97-47fb-0e20-08db0d7a56d3
X-MS-Exchange-CrossTenant-AuthSource: VE1PR08MB4989.eurprd08.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Feb 2023 04:25:29.8931
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: K8jRnhMTKUINB9NAIql3J+lvGiob50WS5mJ6okw0fcD81Rq3pGZM74lnqZm+edmtxziz+HOWMWmVlf0D4RTyME1/wja8m9Gwo95/m4jjbqk=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DU0PR08MB8208
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Here is the stack where we allocate percpu counter block:

  +-< __alloc_percpu
    +-< xt_percpu_counter_alloc
      +-< find_check_entry # {arp,ip,ip6}_tables.c
        +-< translate_table

And it can be leaked on this code path:

  +-> ip6t_register_table
    +-> translate_table # allocates percpu counter block
    +-> xt_register_table # fails

there is no freeing of the counter block on xt_register_table fail.
Note: xt_percpu_counter_free should be called to free it like we do in
do_replace through cleanup_entry helper (or in __ip6t_unregister_table).

Probability of hitting this error path is low AFAICS (xt_register_table
can only return ENOMEM here, as it is not replacing anything, as we are
creating new netns, and it is hard to imagine that all previous
allocations succeeded and after that one in xt_register_table failed).
But it's worth fixing even the rare leak.

Signed-off-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
---
 net/ipv4/netfilter/arp_tables.c | 4 ++++
 net/ipv4/netfilter/ip_tables.c  | 4 ++++
 net/ipv6/netfilter/ip6_tables.c | 4 ++++
 3 files changed, 12 insertions(+)

diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index ffc0cab7cf18..2407066b0fec 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -1525,6 +1525,10 @@ int arpt_register_table(struct net *net,
 
 	new_table = xt_register_table(net, table, &bootstrap, newinfo);
 	if (IS_ERR(new_table)) {
+		struct arpt_entry *iter;
+
+		xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
+			cleanup_entry(iter, net);
 		xt_free_table_info(newinfo);
 		return PTR_ERR(new_table);
 	}
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 2ed7c58b471a..2eb0852ad2b1 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -1742,6 +1742,10 @@ int ipt_register_table(struct net *net, const struct xt_table *table,
 
 	new_table = xt_register_table(net, table, &bootstrap, newinfo);
 	if (IS_ERR(new_table)) {
+		struct ipt_entry *iter;
+
+		xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
+			cleanup_entry(iter, net);
 		xt_free_table_info(newinfo);
 		return PTR_ERR(new_table);
 	}
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 2d816277f2c5..34eeb53bc9fb 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -1751,6 +1751,10 @@ int ip6t_register_table(struct net *net, const struct xt_table *table,
 
 	new_table = xt_register_table(net, table, &bootstrap, newinfo);
 	if (IS_ERR(new_table)) {
+		struct ip6t_entry *iter;
+
+		xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
+			cleanup_entry(iter, net);
 		xt_free_table_info(newinfo);
 		return PTR_ERR(new_table);
 	}
-- 
2.39.1