Netfilter-Devel Archive on lore.kernel.org
 help / color / Atom feed
* [PATCH nft,v2] tests: shell: use-after-free from abort path
@ 2019-08-09 12:49 Pablo Neira Ayuso
  0 siblings, 0 replies; only message in thread
From: Pablo Neira Ayuso @ 2019-08-09 12:49 UTC (permalink / raw)
  To: netfilter-devel

Rule that fails to be added while holding a bound set triggers
user-after-free from the abort path.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
v2: This one reproduces the crash here.

 tests/shell/testcases/transactions/0050rule_1 | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)
 create mode 100755 tests/shell/testcases/transactions/0050rule_1

diff --git a/tests/shell/testcases/transactions/0050rule_1 b/tests/shell/testcases/transactions/0050rule_1
new file mode 100755
index 000000000000..89e5f42fc9f4
--- /dev/null
+++ b/tests/shell/testcases/transactions/0050rule_1
@@ -0,0 +1,19 @@
+#!/bin/bash
+
+set -e
+
+RULESET="table inet filter {
+	flowtable ftable {
+		hook ingress priority 0; devices = { eno1, eno0, x };
+	}
+
+chain forward {
+	type filter hook forward priority 0; policy drop;
+
+	ip protocol { tcp, udp } ct mark and 1 == 1 counter flow add @ftable
+	ip6 nexthdr { tcp, udp } ct mark and 2 == 2 counter flow add @ftable
+	ct mark and 30 == 30 ct state established,related log prefix \"nftables accept: \" level info accept
+	}
+}"
+
+$NFT -f - <<< "$RULESET" >/dev/null || exit 0
-- 
2.11.0


^ permalink raw reply	[flat|nested] only message in thread

only message in thread, back to index

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-08-09 12:49 [PATCH nft,v2] tests: shell: use-after-free from abort path Pablo Neira Ayuso

Netfilter-Devel Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/netfilter-devel/0 netfilter-devel/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 netfilter-devel netfilter-devel/ https://lore.kernel.org/netfilter-devel \
		netfilter-devel@vger.kernel.org netfilter-devel@archiver.kernel.org
	public-inbox-index netfilter-devel


Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.netfilter-devel


AGPL code for this site: git clone https://public-inbox.org/ public-inbox