Merge pull request #13939 from yuwata/network-fix-memleak-and-13938

network: fix memleak and invalid free function

4 files changed, 18 insertions, 5 deletions

diff --git a/src/libsystemd-network/sd-radv.c b/src/libsystemd-network/sd-radv.c
index 5c7f727faa..873a2f40f8 100644
--- a/src/libsystemd-network/sd-radv.c
+++ b/src/libsystemd-network/sd-radv.c
@@ -99,6 +99,13 @@ static sd_radv *radv_free(sd_radv *ra) {
                 sd_radv_prefix_unref(p);
         }
 
+        while (ra->route_prefixes) {
+                sd_radv_route_prefix *p = ra->route_prefixes;
+
+                LIST_REMOVE(prefix, ra->route_prefixes, p);
+                sd_radv_route_prefix_unref(p);
+        }
+
         free(ra->rdnss);
         free(ra->dnssl);
 
diff --git a/src/network/networkd-network.c b/src/network/networkd-network.c
index 90d86f35a9..f6d02fb274 100644
--- a/src/network/networkd-network.c
+++ b/src/network/networkd-network.c
@@ -306,7 +306,7 @@ int network_verify(Network *network) {
 
         LIST_FOREACH_SAFE(prefixes, prefix, prefix_next, network->static_route_prefixes)
                 if (section_is_invalid(prefix->section))
-                        prefix_free(prefix);
+                        route_prefix_free(prefix);
 
         LIST_FOREACH_SAFE(rules, rule, rule_next, network->rules)
                 if (routing_policy_rule_section_verify(rule) < 0)
@@ -654,6 +654,9 @@ static Network *network_free(Network *network) {
         while ((prefix = network->static_prefixes))
                 prefix_free(prefix);
 
+        while ((prefix = network->static_route_prefixes))
+                route_prefix_free(prefix);
+
         while ((rule = network->rules))
                 routing_policy_rule_free(rule);
 
@@ -664,6 +667,7 @@ static Network *network_free(Network *network) {
         hashmap_free(network->neighbors_by_section);
         hashmap_free(network->address_labels_by_section);
         hashmap_free(network->prefixes_by_section);
+        hashmap_free(network->route_prefixes_by_section);
         hashmap_free(network->rules_by_section);
         ordered_hashmap_free_with_destructor(network->qdiscs_by_section, qdisc_free);
 
diff --git a/src/network/networkd-radv.c b/src/network/networkd-radv.c
index 8972c661ae..87db34d6cc 100644
--- a/src/network/networkd-radv.c
+++ b/src/network/networkd-radv.c
@@ -31,7 +31,7 @@ void prefix_free(Prefix *prefix) {
         }
 
         network_config_section_free(prefix->section);
-        prefix->radv_prefix = sd_radv_prefix_unref(prefix->radv_prefix);
+        sd_radv_prefix_unref(prefix->radv_prefix);
 
         free(prefix);
 }
@@ -131,6 +131,7 @@ void route_prefix_free(Prefix *prefix) {
         }
 
         network_config_section_free(prefix->section);
+        sd_radv_route_prefix_unref(prefix->radv_route_prefix);
 
         free(prefix);
 }
@@ -330,7 +331,7 @@ int config_parse_route_prefix(const char *unit,
                               void *userdata) {
 
         Network *network = userdata;
-        _cleanup_(prefix_free_or_set_invalidp) Prefix *p = NULL;
+        _cleanup_(route_prefix_free_or_set_invalidp) Prefix *p = NULL;
         uint8_t prefixlen = 64;
         union in_addr_union in6addr;
         int r;
@@ -372,7 +373,7 @@ int config_parse_route_prefix_lifetime(const char *unit,
                                        void *data,
                                        void *userdata) {
         Network *network = userdata;
-        _cleanup_(prefix_free_or_set_invalidp) Prefix *p = NULL;
+        _cleanup_(route_prefix_free_or_set_invalidp) Prefix *p = NULL;
         usec_t usec;
         int r;
 
@@ -388,7 +389,8 @@ int config_parse_route_prefix_lifetime(const char *unit,
 
         r = parse_sec(rvalue, &usec);
         if (r < 0) {
-                log_syntax(unit, LOG_ERR, filename, line, r, "Roure lifetime is invalid, ignoring assignment: %s", rvalue);
+                log_syntax(unit, LOG_ERR, filename, line, r,
+                           "Route lifetime is invalid, ignoring assignment: %s", rvalue);
                 return 0;
         }
 
diff --git a/test/fuzz/fuzz-network-parser/github-13938 b/test/fuzz/fuzz-network-parser/github-13938
new file mode 100644
index 0000000000..a944a5bc06
--- /dev/null
+++ b/test/fuzz/fuzz-network-parser/github-13938