diff mbox series

[iptables,1/4] nft: cache: Avoid double free of unrecognized base-chains

Message ID 20210922160632.15635-2-phil@nwl.cc
State Changes Requested
Delegated to: Pablo Neira
Headers show
Series nft: Fix and improve base chain handling | expand

Commit Message

Phil Sutter Sept. 22, 2021, 4:06 p.m. UTC 
On error, nft_cache_add_chain() frees the allocated nft_chain object
along with the nftnl_chain it points at. Fix nftnl_chain_list_cb() to
not free the nftnl_chain again in that case.

Fixes: 176c92c26bfc9 ("nft: Introduce a dedicated base chain array")
Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 iptables/nft-cache.c                          |  4 +--
 .../shell/testcases/chain/0004extra-base_0    | 27 +++++++++++++++++++
 2 files changed, 28 insertions(+), 3 deletions(-)
 create mode 100755 iptables/tests/shell/testcases/chain/0004extra-base_0
diff mbox series

Patch

diff --git a/iptables/nft-cache.c b/iptables/nft-cache.c
index 2c88301cc7445..9a03bbfbb32bb 100644
--- a/iptables/nft-cache.c
+++ b/iptables/nft-cache.c
@@ -314,9 +314,7 @@  static int nftnl_chain_list_cb(const struct nlmsghdr *nlh, void *data)
 		goto out;
 	}
 
-	if (nft_cache_add_chain(h, t, c))
-		goto out;
-
+	nft_cache_add_chain(h, t, c);
 	return MNL_CB_OK;
 out:
 	nftnl_chain_free(c);
diff --git a/iptables/tests/shell/testcases/chain/0004extra-base_0 b/iptables/tests/shell/testcases/chain/0004extra-base_0
new file mode 100755
index 0000000000000..1b85b060c1487
--- /dev/null
+++ b/iptables/tests/shell/testcases/chain/0004extra-base_0
@@ -0,0 +1,27 @@ 
+#!/bin/bash
+
+case $XT_MULTI in
+*xtables-nft-multi)
+	;;
+*)
+	echo skip $XT_MULTI
+	exit 0
+	;;
+esac
+
+set -e
+
+nft -f - <<EOF
+table ip filter {
+        chain INPUT {
+                type filter hook input priority filter
+                counter packets 218 bytes 91375 accept
+        }
+
+        chain x {
+                type filter hook input priority filter
+        }
+}
+EOF
+
+$XT_MULTI iptables -L