diff options
| author | Cong Wang <xiyou.wangcong@gmail.com> | 2020-01-10 11:53:08 -0800 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2020-01-13 18:53:59 +0100 |
| commit | c120959387efa51479056fd01dc90adfba7a590c (patch) | |
| tree | 383269c98a778495978a7e56e69962040e4cf600 /net/ipv4/netfilter/arp_tables.c | |
| parent | c9f53049d4a842db6bcd76f597759a0ef5f65c86 (diff) | |
| download | linux-c120959387efa51479056fd01dc90adfba7a590c.tar.gz linux-c120959387efa51479056fd01dc90adfba7a590c.tar.bz2 linux-c120959387efa51479056fd01dc90adfba7a590c.zip | |
netfilter: fix a use-after-free in mtype_destroy()
map->members is freed by ip_set_free() right before using it in
mtype_ext_cleanup() again. So we just have to move it down.
Reported-by: syzbot+4c3cc6dbe7259dbf9054@syzkaller.appspotmail.com
Fixes: 40cd63bf33b2 ("netfilter: ipset: Support extensions which need a per data destroy function")
Acked-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/ipv4/netfilter/arp_tables.c')
0 files changed, 0 insertions, 0 deletions