intervals: deletion should adjust range not yet in the kernel

Do not remove the range if it does not exists yet in the kernel, adjust it
instead.  Uncovered by use-after-free error.

==276702==ERROR: AddressSanitizer: heap-use-after-free on address 0x60d00190663c at pc 0x7ff310ab526f bp 0x7fffeb76f750 sp 0x7fffeb76f748 READ of size 4 at 0x60d00190663c thread T0
    #0 0x7ff310ab526e in __adjust_elem_right .../nftables/src/intervals.c:300
    #1 0x7ff310ab59a7 in adjust_elem_right .../nftables/src/intervals.c:311
    #2 0x7ff310ab6daf in setelem_adjust .../nftables/src/intervals.c:354
    #3 0x7ff310ab783a in setelem_delete .../nftables/src/intervals.c:411
    #4 0x7ff310ab80e6 in __set_delete .../nftables/src/intervals.c:451

Fixes: 3e8d934e4f72 ("intervals: support to partial deletion with automerge")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/src/intervals.c b/src/intervals.c
index 85ec59eda36a36e16973fa68306026d229b9815a..e61adc769c41df563c6b122c5d7c12631a3a88b7 100644 (file)
--- a/src/intervals.c
+++ b/src/intervals.c
@@ -270,9 +270,6 @@ static void remove_elem(struct expr *prev, struct set *set, struct expr *purge)
        if (prev->flags & EXPR_F_KERNEL) {
                clone = expr_clone(prev);
                list_move_tail(&clone->list, &purge->expressions);
-       } else {
-               list_del(&prev->list);
-               expr_free(prev);
        }
 }