* [PATCH nft 1/2] netlink_delinearize: release expressions in context registers
@ 2019-06-10 15:34 Pablo Neira Ayuso
2019-06-10 15:34 ` [PATCH nft 2/2] netlink_delinearize: release expression before calling netlink_parse_concat_expr() Pablo Neira Ayuso
0 siblings, 1 reply; 2+ messages in thread
From: Pablo Neira Ayuso @ 2019-06-10 15:34 UTC (permalink / raw)
To: netfilter-devel
netlink_release_registers() needs to go a bit further to release the
expressions in the register array. This should be safe since
netlink_get_register() clones expressions in the context registers.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
include/netlink.h | 4 +++-
src/netlink_delinearize.c | 6 +++---
2 files changed, 6 insertions(+), 4 deletions(-)
diff --git a/include/netlink.h b/include/netlink.h
index a20ebbe4740c..0c08b1abbf6a 100644
--- a/include/netlink.h
+++ b/include/netlink.h
@@ -14,12 +14,14 @@
#include <rule.h>
+#define MAX_REGS (1 + NFT_REG32_15 - NFT_REG32_00)
+
struct netlink_parse_ctx {
struct list_head *msgs;
struct table *table;
struct rule *rule;
struct stmt *stmt;
- struct expr *registers[1 + NFT_REG32_15 - NFT_REG32_00 + 1];
+ struct expr *registers[MAX_REGS + 1];
unsigned int debug_mask;
};
diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c
index c018e78b0292..a1c775e679e4 100644
--- a/src/netlink_delinearize.c
+++ b/src/netlink_delinearize.c
@@ -63,7 +63,7 @@ static void netlink_set_register(struct netlink_parse_ctx *ctx,
enum nft_registers reg,
struct expr *expr)
{
- if (reg == NFT_REG_VERDICT || reg > 1 + NFT_REG32_15 - NFT_REG32_00) {
+ if (reg == NFT_REG_VERDICT || reg > MAX_REGS) {
netlink_error(ctx, &expr->location,
"Invalid destination register %u", reg);
expr_free(expr);
@@ -82,7 +82,7 @@ static struct expr *netlink_get_register(struct netlink_parse_ctx *ctx,
{
struct expr *expr;
- if (reg == NFT_REG_VERDICT || reg > 1 + NFT_REG32_15 - NFT_REG32_00) {
+ if (reg == NFT_REG_VERDICT || reg > MAX_REGS) {
netlink_error(ctx, loc, "Invalid source register %u", reg);
return NULL;
}
@@ -98,7 +98,7 @@ static void netlink_release_registers(struct netlink_parse_ctx *ctx)
{
int i;
- for (i = 0; i <= NFT_REG_MAX; i++)
+ for (i = 0; i < MAX_REGS; i++)
expr_free(ctx->registers[i]);
}
--
2.11.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* [PATCH nft 2/2] netlink_delinearize: release expression before calling netlink_parse_concat_expr()
2019-06-10 15:34 [PATCH nft 1/2] netlink_delinearize: release expressions in context registers Pablo Neira Ayuso
@ 2019-06-10 15:34 ` Pablo Neira Ayuso
0 siblings, 0 replies; 2+ messages in thread
From: Pablo Neira Ayuso @ 2019-06-10 15:34 UTC (permalink / raw)
To: netfilter-devel
netlink_get_register() clones the expression in the register. Release
this expression before calling netlink_parse_concat_expr() to
deconstruct the concatenation.
==15069== at 0x4C2BBAF: malloc (vg_replace_malloc.c:299)
==15069== by 0x4E79508: xmalloc (utils.c:36)
==15069== by 0x4E795ED: xzalloc (utils.c:65)
==15069== by 0x4E6029B: dtype_alloc (datatype.c:1073)
==15069== by 0x4E6029B: concat_type_alloc (datatype.c:1127)
==15069== by 0x4E6D3B3: netlink_delinearize_set (netlink.c:578)
==15069== by 0x4E6D68E: list_set_cb (netlink.c:648)
==15069== by 0x5F34023: nftnl_set_list_foreach (set.c:780)
==15069== by 0x4E6D6F3: netlink_list_sets (netlink.c:669)
==15069== by 0x4E5A7A3: cache_init_objects (rule.c:159)
==15069== by 0x4E5A7A3: cache_init (rule.c:216)
==15069== by 0x4E5A7A3: cache_update (rule.c:266)
==15069== by 0x4E7E09E: nft_evaluate (libnftables.c:388)
==15069== by 0x4E7E85B: nft_run_cmd_from_buffer (libnftables.c:428)
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
src/netlink_delinearize.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c
index a1c775e679e4..0270e1fd7067 100644
--- a/src/netlink_delinearize.c
+++ b/src/netlink_delinearize.c
@@ -293,6 +293,7 @@ static void netlink_parse_cmp(struct netlink_parse_ctx *ctx,
expr_basetype(left) != &string_type) {
return netlink_error(ctx, loc, "Relational expression size mismatch");
} else if (left->len > 0 && left->len < right->len) {
+ expr_free(left);
left = netlink_parse_concat_expr(ctx, loc, sreg, right->len);
if (left == NULL)
return;
@@ -329,6 +330,7 @@ static void netlink_parse_lookup(struct netlink_parse_ctx *ctx,
"Lookup expression has no left hand side");
if (left->len < set->key->len) {
+ expr_free(left);
left = netlink_parse_concat_expr(ctx, loc, sreg, set->key->len);
if (left == NULL)
return;
@@ -1317,6 +1319,7 @@ static void netlink_parse_dynset(struct netlink_parse_ctx *ctx,
"Dynset statement has no key expression");
if (expr->len < set->key->len) {
+ expr_free(expr);
expr = netlink_parse_concat_expr(ctx, loc, sreg, set->key->len);
if (expr == NULL)
return;
@@ -1408,6 +1411,7 @@ static void netlink_parse_objref(struct netlink_parse_ctx *ctx,
"objref expression has no left hand side");
if (left->len < set->key->len) {
+ expr_free(left);
left = netlink_parse_concat_expr(ctx, loc, sreg, set->key->len);
if (left == NULL)
return;
--
2.11.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-06-10 15:34 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-06-10 15:34 [PATCH nft 1/2] netlink_delinearize: release expressions in context registers Pablo Neira Ayuso
2019-06-10 15:34 ` [PATCH nft 2/2] netlink_delinearize: release expression before calling netlink_parse_concat_expr() Pablo Neira Ayuso
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.