Netfilter-Devel Archive on lore.kernel.org
 help / color / Atom feed
* [PATCH nft] libnftables: use-after-free in exit path
@ 2019-09-11 11:56 Pablo Neira Ayuso
  0 siblings, 0 replies; only message in thread
From: Pablo Neira Ayuso @ 2019-09-11 11:56 UTC (permalink / raw)
  To: netfilter-devel

==29699== Invalid read of size 8
==29699==    at 0x507E140: ct_label_table_exit (ct.c:239)
==29699==    by 0x5091877: nft_exit (libnftables.c:97)
==29699==    by 0x5091877: nft_ctx_free (libnftables.c:297)
[...]
==29699==  Address 0xb251008 is 136 bytes inside a block of size 352 free'd
==29699==    at 0x4C2CDDB: free (vg_replace_malloc.c:530)
==29699==    by 0x509186F: nft_ctx_free (libnftables.c:296)
[...]
==29699==  Block was alloc'd at
==29699==    at 0x4C2DBC5: calloc (vg_replace_malloc.c:711)
==29699==    by 0x508C51D: xmalloc (utils.c:36)
==29699==    by 0x508C51D: xzalloc (utils.c:65)
==29699==    by 0x50916BE: nft_ctx_new (libnftables.c:151)
[...]

Release symbol tables before context object.

Fixes: 45cb29a2ada4 ("src: remove global symbol_table")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 src/libnftables.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/libnftables.c b/src/libnftables.c
index b169dd2f2afe..a19636b22683 100644
--- a/src/libnftables.c
+++ b/src/libnftables.c
@@ -293,8 +293,8 @@ void nft_ctx_free(struct nft_ctx *ctx)
 	cache_release(&ctx->cache);
 	nft_ctx_clear_include_paths(ctx);
 	xfree(ctx->state);
-	xfree(ctx);
 	nft_exit(ctx);
+	xfree(ctx);
 }
 
 EXPORT_SYMBOL(nft_ctx_set_output);
-- 
2.11.0


^ permalink raw reply	[flat|nested] only message in thread

only message in thread, back to index

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-09-11 11:56 [PATCH nft] libnftables: use-after-free in exit path Pablo Neira Ayuso

Netfilter-Devel Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/netfilter-devel/0 netfilter-devel/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 netfilter-devel netfilter-devel/ https://lore.kernel.org/netfilter-devel \
		netfilter-devel@vger.kernel.org netfilter-devel@archiver.kernel.org
	public-inbox-index netfilter-devel

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.netfilter-devel


AGPL code for this site: git clone https://public-inbox.org/ public-inbox