[nft PATCH 0/3] Fix two leaks in error path, one extra

[nft PATCH 0/3] Fix two leaks in error path, one extra

[Phil Sutter]

The first two patches fix for a recent Coverity tool scan. The last one
is unrelated and not worth sending on its own, but matches the other
two's severity.

Phil Sutter (3):
  parser_json: Avoid storage leak in json_parse_set_expr error path
  netlink: Avoid storage leak in tunnel_parse_opt_cb error path
  bison: Drop pointless NULL-check

 src/netlink.c      |  4 +++-
 src/parser_bison.y |  6 ++----
 src/parser_json.c  | 15 ++++++++-------
 3 files changed, 13 insertions(+), 12 deletions(-)

-- 
2.54.0

[nft PATCH 1/3] parser_json: Avoid storage leak in json_parse_set_expr error path

[Phil Sutter]

If parsing jright fails, code frees 'expr' and 'set_expr' before
returning but 'elem' may have been allocated as well. To avoid extra
conditionals when freeing it, parse jright earlier so the code following
conditional 'elem' allocation becomes error-path-free.

Fixes: 144d97e151adb ("src: normalize set element with EXPR_MAPPING")
Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 src/parser_json.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/src/parser_json.c b/src/parser_json.c
index 14259ea39777b..224cbb79de1b8 100644
--- a/src/parser_json.c
+++ b/src/parser_json.c
@@ -1493,13 +1493,6 @@ static struct expr *json_parse_set_expr(struct json_ctx *ctx,
 				return NULL;
 			}
 
-			if (expr->etype != EXPR_SET_ELEM) {
-				elem = set_elem_expr_alloc(int_loc, expr);
-			} else {
-				elem = expr;
-				expr = expr->key;
-			}
-
 			expr2 = json_parse_set_rhs_expr(ctx, jright);
 			if (!expr2) {
 				json_error(ctx, "Invalid set elem at index %zu.", index);
@@ -1507,6 +1500,14 @@ static struct expr *json_parse_set_expr(struct json_ctx *ctx,
 				expr_free(set_expr);
 				return NULL;
 			}
+
+			if (expr->etype != EXPR_SET_ELEM) {
+				elem = set_elem_expr_alloc(int_loc, expr);
+			} else {
+				elem = expr;
+				expr = expr->key;
+			}
+
 			expr2 = mapping_expr_alloc(int_loc, expr, expr2);
 			elem->key = expr2;
 			expr = elem;
-- 
2.54.0

[nft PATCH 2/3] netlink: Avoid storage leak in tunnel_parse_opt_cb error path

[Phil Sutter]

When aborting geneve opt parsing, free the allocated object.

Fixes: 59f03bf14835f ("tunnel: add geneve support")
Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 src/netlink.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/netlink.c b/src/netlink.c
index 8916370604c08..452721ec0be96 100644
--- a/src/netlink.c
+++ b/src/netlink.c
@@ -1960,8 +1960,10 @@ static int tunnel_parse_opt_cb(struct nftnl_tunnel_opt *opt, void *data) {
 		if (nftnl_tunnel_opt_get_flags(opt) & (1 << NFTNL_TUNNEL_GENEVE_DATA)) {
 			gnv_data = nftnl_tunnel_opt_get_data(opt, NFTNL_TUNNEL_GENEVE_DATA,
 							 &geneve->data_len);
-			if (!gnv_data)
+			if (!gnv_data) {
+				free(geneve);
 				return -1;
+			}
 			memcpy(&geneve->data, gnv_data, geneve->data_len);
 		}
 
-- 
2.54.0

[nft PATCH 3/3] bison: Drop pointless NULL-check

[Phil Sutter]

The value returned by basehook_device_name is never NULL since scanner
always sets yyval to an allocated pointer before returning STRING
token.

Fixes: b98fee20bfe23 ("mnl: revisit hook listing")
Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 src/parser_bison.y | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/src/parser_bison.y b/src/parser_bison.y
index 83c0f32322a93..bf2a136796619 100644
--- a/src/parser_bison.y
+++ b/src/parser_bison.y
@@ -1815,10 +1815,8 @@ basehook_spec		:	ruleset_spec
 			}
 			|	ruleset_spec    basehook_device_name
 			{
-				if ($2) {
-					$1.obj.name = $2;
-					$1.obj.location = @2;
-				}
+				$1.obj.name = $2;
+				$1.obj.location = @2;
 				$$ = $1;
 			}
 			;
-- 
2.54.0

Re: [nft PATCH 0/3] Fix two leaks in error path, one extra

[Florian Westphal]

Phil Sutter <phil@nwl.cc> wrote:
> The first two patches fix for a recent Coverity tool scan. The last one
> is unrelated and not worth sending on its own, but matches the other
> two's severity.

Thanks Phil.

Reviewed-by: Florian Westphal <fw@strlen.de>

Re: [nft PATCH 0/3] Fix two leaks in error path, one extra

[Phil Sutter]

On Wed, Nov 11, 2026 at 09:04:11PM +0100, Florian Westphal wrote:
> Phil Sutter <phil@nwl.cc> wrote:
> > The first two patches fix for a recent Coverity tool scan. The last one
> > is unrelated and not worth sending on its own, but matches the other
> > two's severity.
> 
> Thanks Phil.
> 
> Reviewed-by: Florian Westphal <fw@strlen.de>

Series applied, thanks!