diff options
author | Pablo Neira Ayuso <pablo@netfilter.org> | 2019-03-11 13:04:16 +0100 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2019-03-11 13:19:49 +0100 |
commit | 3f3a390dbd59d236f62cff8e8b20355ef7069e3d (patch) | |
tree | bf6c35773213c12d7ce84ae31baa456d17ae9d4f /net/sctp | |
parent | netfilter: nf_tables: bogus EBUSY when deleting set after flush (diff) | |
download | linux-3f3a390dbd59d236f62cff8e8b20355ef7069e3d.tar.xz linux-3f3a390dbd59d236f62cff8e8b20355ef7069e3d.zip |
netfilter: nf_tables: use-after-free in dynamic operations
Smatch reports:
net/netfilter/nf_tables_api.c:2167 nf_tables_expr_destroy()
error: dereferencing freed memory 'expr->ops'
net/netfilter/nf_tables_api.c
2162 static void nf_tables_expr_destroy(const struct nft_ctx *ctx,
2163 struct nft_expr *expr)
2164 {
2165 if (expr->ops->destroy)
2166 expr->ops->destroy(ctx, expr);
^^^^
--> 2167 module_put(expr->ops->type->owner);
^^^^^^^^^
2168 }
Smatch says there are three functions which free expr->ops.
Fixes: b8e204006340 ("netfilter: nft_compat: use .release_ops and remove list of extension")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/sctp')
0 files changed, 0 insertions, 0 deletions