netfilter: nf_tables: release flow rule object from commit path

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2134544
Upstream Status: commit 26b5934

commit 26b5934
Author: Pablo Neira Ayuso <pablo@netfilter.org>
Date:   Wed Oct 26 09:54:45 2022 +0200

    netfilter: nf_tables: release flow rule object from commit path

    No need to postpone this to the commit release path, since no packets
    are walking over this object, this is accessed from control plane only.
    This helped uncovered UAF triggered by races with the netlink notifier.

    Fixes: 9dd732e ("netfilter: nf_tables: memleak flow rule from commit path")
    Reported-by: syzbot+8f747f62763bc6c32916@syzkaller.appspotmail.com
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

Signed-off-by: Florian Westphal <fwestpha@redhat.com>

Author: fw-strlen

net/netfilter/nf_tables_api.c

@@ -8322,9 +8322,6 @@ static void nft_commit_release(struct nft_trans *trans)
 		nf_tables_chain_destroy(&trans->ctx);
 		break;
 	case NFT_MSG_DELRULE:
-		if (trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD)
-			nft_flow_rule_destroy(nft_trans_flow_rule(trans));
-
 		nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
 		break;
 	case NFT_MSG_DELSET:
@@ -8781,6 +8778,9 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)
 			nft_rule_expr_deactivate(&trans->ctx,
 						 nft_trans_rule(trans),
 						 NFT_TRANS_COMMIT);
+
+			if (trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD)
+				nft_flow_rule_destroy(nft_trans_flow_rule(trans));
 			break;
 		case NFT_MSG_NEWSET:
 			nft_clear(net, nft_trans_set(trans));