netlbl_unlabel_init() installs the unlabeled connection hash table and registers a netdevice notifier, but ignores notifier registration errors and always returns success. Check the error and unwind the hash table allocation on failure. Signed-off-by: Minhong He Acked-by: Paul Moore --- v2: - Use rcu_assign_pointer() instead of RCU_INIT_POINTER() when clearing netlbl_unlhsh on notifier registration failure, as suggested by Paul Moore v1: https://lore.kernel.org/all/20260728031043.76586-1-heminhong@kylinos.cn/ net/netlabel/netlabel_unlabeled.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/net/netlabel/netlabel_unlabeled.c b/net/netlabel/netlabel_unlabeled.c index 47bae5e48db6..fe1be424601f 100644 --- a/net/netlabel/netlabel_unlabeled.c +++ b/net/netlabel/netlabel_unlabeled.c @@ -1397,6 +1397,7 @@ static struct notifier_block netlbl_unlhsh_netdev_notifier = { */ int __init netlbl_unlabel_init(u32 size) { + int err; u32 iter; struct netlbl_unlhsh_tbl *hsh_tbl; @@ -1419,7 +1420,16 @@ int __init netlbl_unlabel_init(u32 size) rcu_assign_pointer(netlbl_unlhsh, hsh_tbl); spin_unlock(&netlbl_unlhsh_lock); - register_netdevice_notifier(&netlbl_unlhsh_netdev_notifier); + err = register_netdevice_notifier(&netlbl_unlhsh_netdev_notifier); + if (err) { + spin_lock(&netlbl_unlhsh_lock); + rcu_assign_pointer(netlbl_unlhsh, NULL); + spin_unlock(&netlbl_unlhsh_lock); + synchronize_rcu(); + kfree(hsh_tbl->tbl); + kfree(hsh_tbl); + return err; + } return 0; } -- 2.25.1