[PATCH libftnl 10/12] src: set_elem: list_del before freeing

[Florian Westphal <fw@strlen.de>]

LLM finding:
nftnl_expr_free() calls xfree(expr).
It never calls list_del(&expr->head).

After the loop, expr_list.next/.prev point into freed heap memory.
Next list_add results in UaF.

Looks like noone does such re-use, but as the API allows it, make
this safe.

Signed-off-by: Florian Westphal <fw@strlen.de>
---
 src/set_elem.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/src/set_elem.c b/src/set_elem.c
index 3504a2306e47..0170d0ccefd1 100644
--- a/src/set_elem.c
+++ b/src/set_elem.c
@@ -88,8 +88,10 @@ void nftnl_set_elem_unset(struct nftnl_set_elem *s, uint16_t attr)
 		break;
 	case NFTNL_SET_ELEM_EXPR:
 	case NFTNL_SET_ELEM_EXPRESSIONS:
-		list_for_each_entry_safe(expr, tmp, &s->expr_list, head)
+		list_for_each_entry_safe(expr, tmp, &s->expr_list, head) {
+			list_del(&expr->head);
 			nftnl_expr_free(expr);
+		}
 		break;
 	case NFTNL_SET_ELEM_OBJREF:
 		xfree(s->objref);
@@ -167,8 +169,10 @@ __nftnl_set_elem_set(struct nftnl_set_elem *s, uint16_t attr, const void *data,
 			return -1;
 		break;
 	case NFTNL_SET_ELEM_EXPR:
-		list_for_each_entry_safe(expr, tmp, &s->expr_list, head)
+		list_for_each_entry_safe(expr, tmp, &s->expr_list, head) {
+			list_del(&expr->head);
 			nftnl_expr_free(expr);
+		}
 
 		expr = (void *)data;
 		list_add(&expr->head, &s->expr_list);
-- 
2.55.0