* [PATCH nft] netlink: fix use-after-free netlink_events_cache_deltable()
@ 2015-06-16 16:13 Pablo Neira Ayuso
0 siblings, 0 replies; only message in thread
From: Pablo Neira Ayuso @ 2015-06-16 16:13 UTC (permalink / raw)
To: netfilter-devel; +Cc: kaber
h.table stores a pointer to a nftnl table object that is gone just after
assignment. Release this object once its content is not referenced anymore.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
src/netlink.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/src/netlink.c b/src/netlink.c
index 1167c95..429eed4 100644
--- a/src/netlink.c
+++ b/src/netlink.c
@@ -1982,14 +1982,15 @@ static void netlink_events_cache_deltable(struct netlink_mon_handler *monh,
nlt = netlink_table_alloc(nlh);
h.family = nft_table_attr_get_u32(nlt, NFT_TABLE_ATTR_FAMILY);
h.table = nft_table_attr_get_str(nlt, NFT_TABLE_ATTR_NAME);
- nft_table_free(nlt);
t = table_lookup(&h);
if (t == NULL)
- return;
+ goto out;
list_del(&t->list);
table_free(t);
+out:
+ nft_table_free(nlt);
}
static void netlink_events_cache_addset(struct netlink_mon_handler *monh,
--
1.7.10.4
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2015-06-16 16:08 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-06-16 16:13 [PATCH nft] netlink: fix use-after-free netlink_events_cache_deltable() Pablo Neira Ayuso
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.