netfilter: nf_tables: add missing ->release_ops() in error path of newrule()
authorTaehee Yoo <ap420073@gmail.com>
Tue, 19 Mar 2019 04:22:41 +0000 (13:22 +0900)
committerPablo Neira Ayuso <pablo@netfilter.org>
Wed, 20 Mar 2019 07:32:58 +0000 (08:32 +0100)
commitb25a31bf0ca091aa8bdb9ab329b0226257568bbe
tree7d4239b5e49c3c2686256226d33bdfdfdd75ef10
parent7c9abe12b359d988970c5e38f0e190249e5ae00f
netfilter: nf_tables: add missing ->release_ops() in error path of newrule()

->release_ops() callback releases resources and this is used in error path.
If nf_tables_newrule() fails after ->select_ops(), it should release
resources. but it can not call ->destroy() because that should be called
after ->init().
At this point, ->release_ops() should be used for releasing resources.

Test commands:
   modprobe -rv xt_tcpudp
   iptables-nft -I INPUT -m tcp   <-- error command
   lsmod

Result:
   Module                  Size  Used by
   xt_tcpudp              20480  2      <-- it should be 0

Fixes: b8e204006340 ("netfilter: nft_compat: use .release_ops and remove list of extension")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/netfilter/nf_tables_api.c