Re: [PATCH] netfilter: ipt_CLUSTERIP: fix refcount leak in clusterip_tg_check()

[Florian Westphal]

Xin Xiong <xiongx18@xxxxxxxxxxxx> wrote:
> The issue takes place in one error path of clusterip_tg_check(). When
> memcmp() returns nonzero, the function simply returns the error code,
> forgetting to decrease the reference count of a clusterip_config
> object, which is bumped earlier by clusterip_config_find_get(). This
> may incur reference count leak.
> 
> Fix this issue by decrementing the refcount of the object in specific
> error path.

Fixes: 06aa151ad1fc74 ("netfilter: ipt_CLUSTERIP: check MAC address when duplicate config is set")