Re: [PATCH nf] netfilter: nf_tables: fix flow rule leak in nft_delrule() error path

[Pablo Neira Ayuso]

On Wed, Oct 28, 2026 at 02:22:42PM +0800, Xingyuan Mo wrote:
> On the nf_tables_delrule_deactivate() failure path, nft_trans_destroy()
> frees the transaction but not the attached HW offload flow rule. Destroy
> the flow after the transaction to avoid memory leak.

For the record, alternative proposed patch:

https://patch.msgid.link/netfilter-devel/20261028112535.115054-1-pablo@xxxxxxxxxxxxx

> Fixes: 63b48c73ff56 ("netfilter: nf_tables_offload: undo updates if transaction fails")
> Assisted-by: opencode:deepseek-v4
> Signed-off-by: Xingyuan Mo <hdthky0@xxxxxxxxx>
> ---
>  net/netfilter/nf_tables_api.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
> index 59ac623e6805..ec56ea8c8436 100644
> --- a/net/netfilter/nf_tables_api.c
> +++ b/net/netfilter/nf_tables_api.c
> @@ -752,7 +752,7 @@ static struct nft_trans *nft_trans_rule_add(struct nft_ctx *ctx, int msg_type,
>  
>  static int nft_delrule(struct nft_ctx *ctx, struct nft_rule *rule)
>  {
> -	struct nft_flow_rule *flow;
> +	struct nft_flow_rule *flow = NULL;
>  	struct nft_trans *trans;
>  	int err;
>  
> @@ -773,6 +773,8 @@ static int nft_delrule(struct nft_ctx *ctx, struct nft_rule *rule)
>  	err = nf_tables_delrule_deactivate(ctx, rule);
>  	if (err < 0) {
>  		nft_trans_destroy(trans);
> +		if (flow)
> +			nft_flow_rule_destroy(flow);
>  		return err;
>  	}
>  	nft_rule_expr_deactivate(ctx, rule, NFT_TRANS_PREPARE);
> -- 
> 2.43.0
>