net: fix double-free of nl_cache in initParent error paths#265
Merged
robertswiecki merged 1 commit intoMay 5, 2026
Merged
Conversation
…arent
initParent registers a defer{nl_cache_free(link_cache)} RAII guard that
runs on all exit paths, but the error returns inside the iface_own loop
and the cloneIface block also called nl_cache_free explicitly, causing
a double-free when moveToNs or cloneIface fails.
Remove the redundant explicit frees; the defer guard is sufficient.
|
I don't know why me was mentioned... |
Contributor
Author
|
@robertswiecki can you please take a look |
Collaborator
|
Thank you! |
Open
1 task
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
initParentinnet.ccregisters adefer { nl_cache_free(link_cache); }RAII guard that ensureslink_cacheis freed on all exit paths. However, the error returns inside theiface_ownloop and thecloneIfaceblock also callednl_cache_free(link_cache)explicitly, resulting in a double-free whenmoveToNsorcloneIfacefails.Reproduction
With a configuration that includes
iface_ownset to a nonexistent interface, nsjail callsmoveToNs, which fails becausertnl_link_get_by_namereturnsNULLfor the unknown interface. The explicitnl_cache_freefires, then thedeferguard fires again onreturn false— double-free.Under ASan:
Fix
Remove the two redundant explicit
nl_cache_free(link_cache)calls from the error paths. Thedeferguard is sufficient to freelink_cacheon all code paths.