[PATCH libftnl 00/12] more misc LLM fixes

[Florian Westphal <fw@strlen.de>]

Another round of LLM findings.  These commits are all unrelated,
except that they are LLM findigs with no observed bug reports.

1) Check mnl_nlmsg_batch_start() for a NULL return. Avoid potential NULL
pointer dereference in src/common.

2) Fix uninitialised attr arrays by zero-initialising tb[] arrays.

3) Move several MNL_STRING attribute types to MNL_NUL_STRING so
mnl_attr_validate enforces NUL termination. Harden future
netlink-attribute parsing against non-kernel sources that may omit the
terminator.

4) Validate NFTA_EXPR_NAME parse success. Upgrade string validation to
NUL_STRING, since the kernel always appends a trailing NUL.

5) Forbid re-setting or clearing the object type field to prevent
inconsistent state and segfaults. Check the correct subtype before freeing
to guard against a latent union overlap crash.

6) Drop trailing semicolon from the xfree macro. Callers already append their
own ;, so the macro's is redundant.

7) Remove the obsolete set_elem member from the ruleset union. Its last
consumer (the removed json interface) no longer exists, and the shared
nftnl_set_free path masked a latent type-confusion bug.

8) Clear field_len array before copying to avoid reading stale values from a
prior call. Fix a bug where shrinking the array on a second invocation
leaks leftover field counts.

9) Guard the s->expr_list traversal against the empty-list case to avoid
returning a pointer into the middle of nftnl_set. Initialize data_len to 0.

10) Fix use-after-free by calling list_del() before freeing expressions in
set_elem. Prevents dangling next/prev pointers from corrupting a
subsequent list_add on the same list.

11) Clamp buf->end to the actually copied size in udata_buf_put. Prevent
nftnl_udata_buf_space() from observing an end pointer past the buffer.

12) Remove all remaining MNL_STRING users, switch to MNL_NUL_STRING and
mnl_attr_put_strz. Enforce NUL-termination checking on all string
attributes to prevent illegal strlen/strdup on unchecked data.

Florian Westphal (12):
  src: common: mnl_nlmsg_batch_start may return NULL
  src: fix uninitialised attr arrays
  src: move several MNL_STRING types to MNL_NUL_STRING
  src: expr: make sure NFTA_EXPR_NAME was parsed successfuly
  src: object: don't permit to re-set or clear object type field
  include: drop semicolon at end of xfree macro
  src: ruleset: remove set_elem member from union
  src: set: clear field_len array before copying
  src: set: check for empty list explicitly
  src: set_elem: list_del before freeing
  src: udata: clamp buf->end to actally copied size
  src: remove all remaining MNL_STRING users

 examples/nft-compat-get.c |  2 +-
 include/utils.h           |  2 +-
 src/chain.c               |  4 ++--
 src/common.c              |  4 ++++
 src/expr.c                |  5 ++++-
 src/expr/data_reg.c       |  4 ++--
 src/expr/dynset.c         |  2 +-
 src/expr/flow_offload.c   |  2 +-
 src/expr/log.c            |  2 +-
 src/expr/lookup.c         |  2 +-
 src/expr/objref.c         |  6 +++---
 src/flowtable.c           |  2 +-
 src/obj/ct_helper.c       |  4 ++--
 src/obj/secmark.c         |  4 ++--
 src/object.c              | 19 +++++++++++++++----
 src/rule.c                |  2 +-
 src/ruleset.c             |  3 +--
 src/set.c                 | 13 +++++++------
 src/set_elem.c            | 10 +++++++---
 src/table.c               |  2 +-
 src/trace.c               |  6 +++---
 src/udata.c               |  5 ++++-
 src/utils.c               |  5 +++--
 23 files changed, 68 insertions(+), 42 deletions(-)

-- 
2.55.0