* [Patch net] netfilter: fix a use-after-free in mtype_destroy()
@ 2020-01-10 19:53 Cong Wang
2020-01-13 17:50 ` Pablo Neira Ayuso
0 siblings, 1 reply; 2+ messages in thread
From: Cong Wang @ 2020-01-10 19:53 UTC (permalink / raw)
To: netdev
Cc: netfilter-devel, Cong Wang, syzbot+4c3cc6dbe7259dbf9054,
Pablo Neira Ayuso, Jozsef Kadlecsik
map->members is freed by ip_set_free() right before using it in
mtype_ext_cleanup() again. So we just have to move it down.
Reported-by: syzbot+4c3cc6dbe7259dbf9054@syzkaller.appspotmail.com
Fixes: 40cd63bf33b2 ("netfilter: ipset: Support extensions which need a per data destroy function")
Cc: Pablo Neira Ayuso <pablo@netfilter.org>
Acked-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
---
net/netfilter/ipset/ip_set_bitmap_gen.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/netfilter/ipset/ip_set_bitmap_gen.h b/net/netfilter/ipset/ip_set_bitmap_gen.h
index 1abd6f0dc227..077a2cb65fcb 100644
--- a/net/netfilter/ipset/ip_set_bitmap_gen.h
+++ b/net/netfilter/ipset/ip_set_bitmap_gen.h
@@ -60,9 +60,9 @@ mtype_destroy(struct ip_set *set)
if (SET_WITH_TIMEOUT(set))
del_timer_sync(&map->gc);
- ip_set_free(map->members);
if (set->dsize && set->extensions & IPSET_EXT_DESTROY)
mtype_ext_cleanup(set);
+ ip_set_free(map->members);
ip_set_free(map);
set->data = NULL;
--
2.21.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [Patch net] netfilter: fix a use-after-free in mtype_destroy()
2020-01-10 19:53 [Patch net] netfilter: fix a use-after-free in mtype_destroy() Cong Wang
@ 2020-01-13 17:50 ` Pablo Neira Ayuso
0 siblings, 0 replies; 2+ messages in thread
From: Pablo Neira Ayuso @ 2020-01-13 17:50 UTC (permalink / raw)
To: Cong Wang
Cc: netdev, netfilter-devel, syzbot+4c3cc6dbe7259dbf9054, Jozsef Kadlecsik
On Fri, Jan 10, 2020 at 11:53:08AM -0800, Cong Wang wrote:
> map->members is freed by ip_set_free() right before using it in
> mtype_ext_cleanup() again. So we just have to move it down.
Applied, thanks.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2020-01-13 17:50 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-01-10 19:53 [Patch net] netfilter: fix a use-after-free in mtype_destroy() Cong Wang
2020-01-13 17:50 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).