From b73298405cda74b3a87a1818bb92f53298d34170 Mon Sep 17 00:00:00 2001 From: Florian Westphal Date: Mon, 15 Jan 2024 14:27:15 +0100 Subject: rule: fix sym refcount assertion Scope release must happen last. afl provided a reproducer where policy is a define, because scope is released too early we get: nft: src/rule.c:559: scope_release: Assertion `sym->refcnt == 1' failed. ... because chain->policy is EXPR_SYMBOL. Fixes: 627c451b2351 ("src: allow variables in the chain priority specification") Signed-off-by: Florian Westphal --- src/rule.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'src/rule.c') diff --git a/src/rule.c b/src/rule.c index 172ba1f6..342c43fb 100644 --- a/src/rule.c +++ b/src/rule.c @@ -729,7 +729,6 @@ void chain_free(struct chain *chain) list_for_each_entry_safe(rule, next, &chain->rules, list) rule_free(rule); handle_free(&chain->handle); - scope_release(&chain->scope); free_const(chain->type.str); expr_free(chain->dev_expr); for (i = 0; i < chain->dev_array_len; i++) @@ -738,6 +737,11 @@ void chain_free(struct chain *chain) expr_free(chain->priority.expr); expr_free(chain->policy); free_const(chain->comment); + + /* MUST be released after all expressions, they could + * hold refcounts. + */ + scope_release(&chain->scope); free(chain); } -- cgit v1.2.3