[PATCH v2] ulogd2: Avoid use after free in unregister on global ulogd_fds linked list

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



The issue "core dumped" occurred  from
ulogd_unregister_fd(). One of the processes is unlink
from list and remove, but some struct 'pi' values
freed without ulogd_unregister_fd().
Unlink process needs to access the previous pointer
value of struct 'pi', but it was already freed.

Therefore, the free() process moved location
after finishing all ulogd_unregister_fd().

Signed-off-by: Kyuwon Shim <kyuwon.shim@xxxxxxxxxxxxxxxxxxx>
---

Notes:
    Add new patch revision in plain-text that applies cleanly to master

 src/ulogd.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/ulogd.c b/src/ulogd.c
index 8ea9793ec..944637e0d 100644
--- a/src/ulogd.c
+++ b/src/ulogd.c
@@ -1334,6 +1334,11 @@ static void stop_pluginstances()
 				(*pi->plugin->stop)(pi);
 				pi->private[0] = 0;
 			}
+		}
+	}
+
+	llist_for_each_entry(stack, &ulogd_pi_stacks, stack_list) {
+		llist_for_each_entry_safe(pi, npi, &stack->list, list) {
 			free(pi);
 		}
 	}
-- 
2.39.0




[Index of Archives]     [Netfitler Users]     [Berkeley Packet Filter]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux