Skip to content

net: fix double-free of nl_cache in initParent error paths#265

Merged
robertswiecki merged 1 commit into
google:masterfrom
sharadboni:fix/double-free-nl-cache-initParent
May 5, 2026
Merged

net: fix double-free of nl_cache in initParent error paths#265
robertswiecki merged 1 commit into
google:masterfrom
sharadboni:fix/double-free-nl-cache-initParent

Conversation

@sharadboni
Copy link
Copy Markdown
Contributor

Summary

initParent in net.cc registers a defer { nl_cache_free(link_cache); } RAII guard that ensures link_cache is freed on all exit paths. However, the error returns inside the iface_own loop and the cloneIface block also called nl_cache_free(link_cache) explicitly, resulting in a double-free when moveToNs or cloneIface fails.

Reproduction

With a configuration that includes iface_own set to a nonexistent interface, nsjail calls moveToNs, which fails because rtnl_link_get_by_name returns NULL for the unknown interface. The explicit nl_cache_free fires, then the defer guard fires again on return false — double-free.

Under ASan:

AddressSanitizer:DEADLYSIGNAL
ERROR: AddressSanitizer: SEGV on unknown address
    in nl_cache_clear (libnl-3.so.200)
    in nl_cache_free (libnl-3.so.200)

Fix

Remove the two redundant explicit nl_cache_free(link_cache) calls from the error paths. The defer guard is sufficient to free link_cache on all code paths.

…arent

initParent registers a defer{nl_cache_free(link_cache)} RAII guard that
runs on all exit paths, but the error returns inside the iface_own loop
and the cloneIface block also called nl_cache_free explicitly, causing
a double-free when moveToNs or cloneIface fails.

Remove the redundant explicit frees; the defer guard is sufficient.
@mtasaka
Copy link
Copy Markdown

mtasaka commented Apr 28, 2026

I don't know why me was mentioned...

@sharadboni
Copy link
Copy Markdown
Contributor Author

@robertswiecki can you please take a look

@robertswiecki
Copy link
Copy Markdown
Collaborator

Thank you!

@robertswiecki robertswiecki merged commit 9853352 into google:master May 5, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants