]> git.ipfire.org Git - thirdparty/nftables.git/commit
tests: shell: add regression test for double-free crash bug
authorFlorian Westphal <fw@strlen.de>
Fri, 8 Mar 2024 19:57:26 +0000 (20:57 +0100)
committerFlorian Westphal <fw@strlen.de>
Tue, 2 Apr 2024 13:46:14 +0000 (15:46 +0200)
commitb237aeff41840f0c7968d02ed3d461fa9fa8fb70
tree6c0a507fb425e3e0dc0b9d3ca1074c78ebf0b3b7
parenta2a7fbdfdd7f8dc5baa4cc8a23753b96bbc8a433
tests: shell: add regression test for double-free crash bug

BUG: KASAN: slab-use-after-free in nf_tables_set_elem_destroy+0x55/0x160
Call Trace:
 nf_tables_set_elem_destroy+0x55/0x160
 nf_tables_set_elem_destroy+0x55/0x160
 nft_pipapo_destroy+0x3b4/0x5a0
 nft_set_destroy+0x118/0x3a0
 nf_tables_trans_destroy_work+0x4f2/0xa80

This is a test case for the bug fiex with kernel commit
b0e256f3dd2b ("netfilter: nft_set_pipapo: release elements in clone only from destroy path").

Reported-by: lonial con <kongln9170@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
tests/shell/testcases/transactions/concat_range_abort [new file with mode: 0755]
tests/shell/testcases/transactions/dumps/concat_range_abort.json-nft [new file with mode: 0644]
tests/shell/testcases/transactions/dumps/concat_range_abort.nft [new file with mode: 0644]