From: Florian Westphal <fw@strlen.de>
To: <netfilter-devel@vger.kernel.org>
Cc: Florian Westphal <fw@strlen.de>
Subject: [PATCH libnftnl 0/7] misc LLM fixes
Date: Fri, 23 Oct 2026 15:57:59 +0200 [thread overview]
Message-ID: <20261023135806.7259-1-fw@strlen.de> (raw)
The only thing these changes have in common is that they are all
LLM findings.
1) Prevent out-of-bounds read in str_array.h, this doesn't cause crash, the
value that is read off the end of the array is not used.
2) Fix NFTNL_CHAIN_TYPE data_len to return the string length, consistent with
other attributes.
3) Fix fd leak in nftnl_batch_is_supported when mnl_socket_bind() fails.
Close the already-open socket on the error path.
4) Free partially-allocated sub-objects in nftnl_expr_parse error path via
nftnl_expr_free. Fixes memory leaks (e.g., dynset set_name) when parsing
embedded expressions fails after allocation.
5) Allow unsetting NFTNL_FLOWTABLE_SIZE.
6) Fix pointer state inconsistency by freeing the old value only after
strndup succeeds. Delegate nftnl_parse_str_attr to the fixed helper
instead of open-coding the same bug.
7) Add nftnl_mem_blob helper for user_data and switch all users to it,
resolving inconsistent state on alloc failure.
Florian Westphal (7):
include: str_array.h: avoid oob read
src: chain: fix NFTNL_CHAIN_TYPE data_len
src: common: fix fd leak in nftnl_batch_is_supported
expr: nftnl_expr_parse: use nftnl_expr_free on error unwind
src: flowtable: allow to unset NFTNL_FLOWTABLE_SIZE
src: utils: keep old name if strndup fails
src: add and use nftnl_mem_blob for user_data
include/obj.h | 5 +----
include/rule.h | 5 +----
include/set.h | 5 +----
include/set_elem.h | 6 ++----
include/str_array.h | 8 ++++----
include/utils.h | 24 ++++++++++++++++++++++++
src/chain.c | 25 ++++++++-----------------
src/common.c | 5 ++++-
src/expr.c | 2 +-
src/flowtable.c | 1 +
src/object.c | 18 ++++++------------
src/rule.c | 41 +++++++++++++----------------------------
src/set.c | 18 ++++++------------
src/set_elem.c | 31 +++++++++++--------------------
src/table.c | 23 +++++++----------------
src/utils.c | 43 ++++++++++++++++++++++++++++++++-----------
16 files changed, 122 insertions(+), 138 deletions(-)
--
2.55.0
next reply other threads:[~2026-10-23 13:58 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-23 13:57 Florian Westphal [this message]
2026-10-23 13:58 ` [PATCH libnftnl 1/7] include: str_array.h: avoid oob read Florian Westphal
2026-10-23 13:58 ` [PATCH libnftnl 2/7] src: chain: fix NFTNL_CHAIN_TYPE data_len Florian Westphal
2026-10-23 13:58 ` [PATCH libnftnl 3/7] src: common: fix fd leak in nftnl_batch_is_supported Florian Westphal
2026-10-23 13:58 ` [PATCH libnftnl 4/7] expr: nftnl_expr_parse: use nftnl_expr_free on error unwind Florian Westphal
2026-10-23 13:58 ` [PATCH libnftnl 5/7] src: flowtable: allow to unset NFTNL_FLOWTABLE_SIZE Florian Westphal
2026-10-23 13:58 ` [PATCH libnftnl 6/7] src: utils: keep old name if strndup fails Florian Westphal
2026-10-23 13:58 ` [PATCH libnftnl 7/7] src: add and use nftnl_mem_blob for user_data Florian Westphal
2026-10-26 14:46 ` [PATCH libnftnl 0/7] misc LLM fixes Fernando Fernandez Mancera
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261023135806.7259-1-fw@strlen.de \
--to=fw@strlen.de \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.