diff options
author | Florian Westphal <fw@strlen.de> | 2024-01-15 14:27:15 +0100 |
---|---|---|
committer | Florian Westphal <fw@strlen.de> | 2024-01-15 18:21:41 +0100 |
commit | b73298405cda74b3a87a1818bb92f53298d34170 (patch) | |
tree | 0e43557cdb9c02265d24a1e2c657dbae87921806 /src | |
parent | 8a66de2a15943b2fbf960967cdbcbd0a148cb114 (diff) |
rule: fix sym refcount assertion
Scope release must happen last.
afl provided a reproducer where policy is a define, because
scope is released too early we get:
nft: src/rule.c:559: scope_release: Assertion `sym->refcnt == 1' failed.
... because chain->policy is EXPR_SYMBOL.
Fixes: 627c451b2351 ("src: allow variables in the chain priority specification")
Signed-off-by: Florian Westphal <fw@strlen.de>
Diffstat (limited to 'src')
-rw-r--r-- | src/rule.c | 6 |
1 files changed, 5 insertions, 1 deletions
@@ -729,7 +729,6 @@ void chain_free(struct chain *chain) list_for_each_entry_safe(rule, next, &chain->rules, list) rule_free(rule); handle_free(&chain->handle); - scope_release(&chain->scope); free_const(chain->type.str); expr_free(chain->dev_expr); for (i = 0; i < chain->dev_array_len; i++) @@ -738,6 +737,11 @@ void chain_free(struct chain *chain) expr_free(chain->priority.expr); expr_free(chain->policy); free_const(chain->comment); + + /* MUST be released after all expressions, they could + * hold refcounts. + */ + scope_release(&chain->scope); free(chain); } |