diff options
| author | Pablo Neira Ayuso | 2019-03-11 13:04:16 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman | 2019-05-16 19:41:26 +0200 |
| commit | 5014aa93742293b4622b8d766ad0b08db2611f7f (patch) | |
| tree | cc1c518b6123d6e588ae16353fc7c60e8002a753 /net/netfilter | |
| parent | usb: typec: Fix unchecked return value (diff) | |
| download | kernel-qcow2-linux-5014aa93742293b4622b8d766ad0b08db2611f7f.tar.gz kernel-qcow2-linux-5014aa93742293b4622b8d766ad0b08db2611f7f.tar.xz kernel-qcow2-linux-5014aa93742293b4622b8d766ad0b08db2611f7f.zip | |
netfilter: nf_tables: use-after-free in dynamic operations
[ Upstream commit 3f3a390dbd59d236f62cff8e8b20355ef7069e3d ]
Smatch reports:
net/netfilter/nf_tables_api.c:2167 nf_tables_expr_destroy()
error: dereferencing freed memory 'expr->ops'
net/netfilter/nf_tables_api.c
2162 static void nf_tables_expr_destroy(const struct nft_ctx *ctx,
2163 struct nft_expr *expr)
2164 {
2165 if (expr->ops->destroy)
2166 expr->ops->destroy(ctx, expr);
^^^^
--> 2167 module_put(expr->ops->type->owner);
^^^^^^^^^
2168 }
Smatch says there are three functions which free expr->ops.
Fixes: b8e204006340 ("netfilter: nft_compat: use .release_ops and remove list of extension")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Diffstat (limited to 'net/netfilter')
| -rw-r--r-- | net/netfilter/nf_tables_api.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index f272f9538c44..ef7ff13a7b99 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -2113,9 +2113,11 @@ err1: static void nf_tables_expr_destroy(const struct nft_ctx *ctx, struct nft_expr *expr) { + const struct nft_expr_type *type = expr->ops->type; + if (expr->ops->destroy) expr->ops->destroy(ctx, expr); - module_put(expr->ops->type->owner); + module_put(type->owner); } struct nft_expr *nft_expr_init(const struct nft_ctx *ctx, |