datatype: add DTYPE_F_CLONE flag

This flag allows us to identify datatypes that are instances from
original datatypes.

This fixes a possible double free when attaching a concatenation
datatype to set->keytype while being also referenced from concatenation
expressions.

ip6/flowtable.t: ERROR: line 5: src/nft add rule --debug=netlink ip6 test-ip6 input flow table acct_out { meta iif . ip6 saddr timeout 600s counter }: This rule should not have failed.
*** Error in `src/nft': double free or corruption (fasttop): 0x000000000117ce70 ***

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/datatype.h b/include/datatype.h
index 68fb2a6c2431688c2382c662154ea04294f5d239..3ce3a888f0635c8972916f7879747deccefee710 100644 (file)
--- a/include/datatype.h
+++ b/include/datatype.h
@@ -109,10 +109,12 @@ struct expr;
  *
  * @DTYPE_F_ALLOC:             datatype is dynamically allocated
  * @DTYPE_F_PREFIX:            preferred representation for ranges is a prefix
+ * @DTYPE_F_CLONE:             this is an instance from original datatype
  */
 enum datatype_flags {
        DTYPE_F_ALLOC           = (1 << 0),
        DTYPE_F_PREFIX          = (1 << 1),
+       DTYPE_F_CLONE           = (1 << 2),
 };
 
 /**

diff --git a/src/datatype.c b/src/datatype.c
index bfc8817c2b837d754566a0360138898dabaed3e0..64b8b8845b1064bfdef58f13efb70344aa39c300 100644 (file)
--- a/src/datatype.c
+++ b/src/datatype.c
@@ -973,7 +973,7 @@ static struct datatype *dtype_clone(const struct datatype *orig_dtype)
        *dtype = *orig_dtype;
        dtype->name = xstrdup(orig_dtype->name);
        dtype->desc = xstrdup(orig_dtype->desc);
-       dtype->flags = DTYPE_F_ALLOC;
+       dtype->flags = DTYPE_F_ALLOC | DTYPE_F_CLONE;
 
        return dtype;
 }
@@ -1046,7 +1046,8 @@ const struct datatype *set_keytype_alloc(const struct datatype *orig_dtype,
 
 void set_keytype_destroy(const struct datatype *dtype)
 {
-       dtype_free(dtype);
+       if (dtype->flags & DTYPE_F_CLONE)
+               dtype_free(dtype);
 }
 
 static struct error_record *time_unit_parse(const struct location *loc,