tree 40f32185e865c11fcb4b747f044d525db466f176
parent 7355bfe0e0cc27597d530f78e259a985cb85af40
author Florian Westphal <fw@strlen.de> 1642947840 +0100
committer Pablo Neira Ayuso <pablo@netfilter.org> 1643238189 +0100

netfilter: nft_ct: fix use after free when attaching zone template

The conversion erroneously removed the refcount increment.
In case we can use the percpu template, we need to increment
the refcount, else it will be released when the skb gets freed.

In case the slowpath is taken, the new template already has a
refcount of 1.

Fixes: 719774377622 ("netfilter: conntrack: convert to refcount_t api")
Reported-by: kernel test robot <oliver.sang@intel.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>