[PATCH nft] src: fix double free on xt stmt destruction

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



'nft monitor' dies with:
*** Error in `/sbin/nft': double free or corruption (fasttop): 0x000055f8ba57b750 ***

... when the iptables-nft test suite is running in parallel, because
xfree(stmt->xt.name) gets called twice.

Fixes: 4ac11b890fe870 ("src: missing destroy function in statement definitions")
Signed-off-by: Florian Westphal <fw@xxxxxxxxx>
---
 include/xt.h    | 2 +-
 src/statement.c | 6 ------
 src/xt.c        | 2 +-
 3 files changed, 2 insertions(+), 8 deletions(-)

diff --git a/include/xt.h b/include/xt.h
index ab59bb3d45a4..9fc515084d59 100644
--- a/include/xt.h
+++ b/include/xt.h
@@ -9,7 +9,7 @@ struct rule;
 struct output_ctx;
 
 void xt_stmt_xlate(const struct stmt *stmt, struct output_ctx *octx);
-void xt_stmt_release(const struct stmt *stmt);
+void xt_stmt_destroy(struct stmt *stmt);
 
 void netlink_parse_target(struct netlink_parse_ctx *ctx,
 			  const struct location *loc,
diff --git a/src/statement.c b/src/statement.c
index b2370f8710a4..7f9c10b38244 100644
--- a/src/statement.c
+++ b/src/statement.c
@@ -866,12 +866,6 @@ static void xt_stmt_print(const struct stmt *stmt, struct output_ctx *octx)
 	xt_stmt_xlate(stmt, octx);
 }
 
-static void xt_stmt_destroy(struct stmt *stmt)
-{
-	xfree(stmt->xt.name);
-	xt_stmt_release(stmt);
-}
-
 static const struct stmt_ops xt_stmt_ops = {
 	.type		= STMT_XT,
 	.name		= "xt",
diff --git a/src/xt.c b/src/xt.c
index 906b2fde10e1..b0f5a30c46b5 100644
--- a/src/xt.c
+++ b/src/xt.c
@@ -78,7 +78,7 @@ void xt_stmt_xlate(const struct stmt *stmt, struct output_ctx *octx)
 #endif
 }
 
-void xt_stmt_release(const struct stmt *stmt)
+void xt_stmt_destroy(struct stmt *stmt)
 {
 #ifdef HAVE_LIBXTABLES
 	switch (stmt->xt.type) {
-- 
2.21.0




[Index of Archives]     [Netfitler Users]     [Berkeley Packet Filter]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux