* [PATCH nft] intervals: deletion should adjust range not yet in the kernel
@ 2022-05-07 21:30 Pablo Neira Ayuso
0 siblings, 0 replies; only message in thread
From: Pablo Neira Ayuso @ 2022-05-07 21:30 UTC (permalink / raw)
To: netfilter-devel
Do not remove the range if it does not exists yet in the kernel, adjust it
instead. Uncovered by use-after-free error.
==276702==ERROR: AddressSanitizer: heap-use-after-free on address 0x60d00190663c at pc 0x7ff310ab526f bp 0x7fffeb76f750 sp 0x7fffeb76f748 READ of size 4 at 0x60d00190663c thread T0
#0 0x7ff310ab526e in __adjust_elem_right .../nftables/src/intervals.c:300
#1 0x7ff310ab59a7 in adjust_elem_right .../nftables/src/intervals.c:311
#2 0x7ff310ab6daf in setelem_adjust .../nftables/src/intervals.c:354
#3 0x7ff310ab783a in setelem_delete .../nftables/src/intervals.c:411
#4 0x7ff310ab80e6 in __set_delete .../nftables/src/intervals.c:451
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
src/intervals.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/src/intervals.c b/src/intervals.c
index 85ec59eda36a..e61adc769c41 100644
--- a/src/intervals.c
+++ b/src/intervals.c
@@ -270,9 +270,6 @@ static void remove_elem(struct expr *prev, struct set *set, struct expr *purge)
if (prev->flags & EXPR_F_KERNEL) {
clone = expr_clone(prev);
list_move_tail(&clone->list, &purge->expressions);
- } else {
- list_del(&prev->list);
- expr_free(prev);
}
}
--
2.30.2
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2022-05-07 21:30 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-05-07 21:30 [PATCH nft] intervals: deletion should adjust range not yet in the kernel Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).