diff options
| author | Florian Westphal <fw@strlen.de> | 2024-01-15 14:27:15 +0100 |
|---|---|---|
| committer | Florian Westphal <fw@strlen.de> | 2024-01-15 18:21:41 +0100 |
| commit | b73298405cda74b3a87a1818bb92f53298d34170 (patch) | |
| tree | 0e43557cdb9c02265d24a1e2c657dbae87921806 | |
| parent | 8a66de2a15943b2fbf960967cdbcbd0a148cb114 (diff) | |
rule: fix sym refcount assertion
Scope release must happen last.
afl provided a reproducer where policy is a define, because
scope is released too early we get:
nft: src/rule.c:559: scope_release: Assertion `sym->refcnt == 1' failed.
... because chain->policy is EXPR_SYMBOL.
Fixes: 627c451b2351 ("src: allow variables in the chain priority specification")
Signed-off-by: Florian Westphal <fw@strlen.de>
| -rw-r--r-- | src/rule.c | 6 | ||||
| -rw-r--r-- | tests/shell/testcases/bogons/nft-f/define_policy_assert | 3 |
2 files changed, 8 insertions, 1 deletions
@@ -729,7 +729,6 @@ void chain_free(struct chain *chain) list_for_each_entry_safe(rule, next, &chain->rules, list) rule_free(rule); handle_free(&chain->handle); - scope_release(&chain->scope); free_const(chain->type.str); expr_free(chain->dev_expr); for (i = 0; i < chain->dev_array_len; i++) @@ -738,6 +737,11 @@ void chain_free(struct chain *chain) expr_free(chain->priority.expr); expr_free(chain->policy); free_const(chain->comment); + + /* MUST be released after all expressions, they could + * hold refcounts. + */ + scope_release(&chain->scope); free(chain); } diff --git a/tests/shell/testcases/bogons/nft-f/define_policy_assert b/tests/shell/testcases/bogons/nft-f/define_policy_assert new file mode 100644 index 00000000..f1e58b55 --- /dev/null +++ b/tests/shell/testcases/bogons/nft-f/define_policy_assert @@ -0,0 +1,3 @@ +chain y x { priority filter +define p = foo +policy $p |