From c224aa6bc04fec945bd941aadccdb388b3ba32e6 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Fri, 6 May 2022 23:46:59 +0200 Subject: intervals: deletion should adjust range not yet in the kernel Do not remove the range if it does not exists yet in the kernel, adjust it instead. Uncovered by use-after-free error. ==276702==ERROR: AddressSanitizer: heap-use-after-free on address 0x60d00190663c at pc 0x7ff310ab526f bp 0x7fffeb76f750 sp 0x7fffeb76f748 READ of size 4 at 0x60d00190663c thread T0 #0 0x7ff310ab526e in __adjust_elem_right .../nftables/src/intervals.c:300 #1 0x7ff310ab59a7 in adjust_elem_right .../nftables/src/intervals.c:311 #2 0x7ff310ab6daf in setelem_adjust .../nftables/src/intervals.c:354 #3 0x7ff310ab783a in setelem_delete .../nftables/src/intervals.c:411 #4 0x7ff310ab80e6 in __set_delete .../nftables/src/intervals.c:451 Fixes: 3e8d934e4f72 ("intervals: support to partial deletion with automerge") Signed-off-by: Pablo Neira Ayuso --- src/intervals.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/src/intervals.c b/src/intervals.c index 85ec59ed..e61adc76 100644 --- a/src/intervals.c +++ b/src/intervals.c @@ -270,9 +270,6 @@ static void remove_elem(struct expr *prev, struct set *set, struct expr *purge) if (prev->flags & EXPR_F_KERNEL) { clone = expr_clone(prev); list_move_tail(&clone->list, &purge->expressions); - } else { - list_del(&prev->list); - expr_free(prev); } } -- cgit v1.2.3