OSDN Git Service

(root) / tomoyo / tomoyo-test1.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: c9f5304) | patch
netfilter: fix a use-after-free in mtype_destroy()
authorCong Wang <xiyou.wangcong@gmail.com>
Fri, 10 Jan 2020 19:53:08 +0000 (11:53 -0800)
committerPablo Neira Ayuso <pablo@netfilter.org>
Mon, 13 Jan 2020 17:53:59 +0000 (18:53 +0100)
commitc120959387efa51479056fd01dc90adfba7a590c
tree383269c98a778495978a7e56e69962040e4cf600tree | snapshot
parentc9f53049d4a842db6bcd76f597759a0ef5f65c86commit | diff
netfilter: fix a use-after-free in mtype_destroy()

map->members is freed by ip_set_free() right before using it in
mtype_ext_cleanup() again. So we just have to move it down.

Reported-by: syzbot+4c3cc6dbe7259dbf9054@syzkaller.appspotmail.com
Fixes: 40cd63bf33b2 ("netfilter: ipset: Support extensions which need a per data destroy function")
Acked-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/netfilter/ipset/ip_set_bitmap_gen.h diff | blob | history
This is a test repository.
About OSDN
Find Software
Develop Software
Help