netfilter: nf_tables: drop module reference after updating chain

commit 043d2acf57227db1fdaaa620b2a420acfaa56d6e upstream.

Otherwise the module reference counter is leaked.

Fixes b9703ed44ffb ("netfilter: nf_tables: support for adding new devices to an existing netdev chain")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index b9e276820c722122ad8cd11be40c80c06bb164ee..398bb8fb30a52ef8232fab98fad81ec3f06be384 100644 (file)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -2664,6 +2664,8 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy,
        nft_trans_basechain(trans) = basechain;
        INIT_LIST_HEAD(&nft_trans_chain_hooks(trans));
        list_splice(&hook.list, &nft_trans_chain_hooks(trans));
+       if (nla[NFTA_CHAIN_HOOK])
+               module_put(hook.type->owner);
 
        nft_trans_commit_list_add_tail(ctx->net, trans);