From: Thomas Haller <thaller@redhat.com>
Date: Fri, 6 Apr 2018 14:42:55 +0000 (+0200)
Subject: route/mall: fix deep cloning mall
X-Git-Tag: libnl3_5_0~37^2
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=1c703b84beb0577b8910d6e7c64c94a64e68ab32;p=libnl

route/mall: fix deep cloning mall

rtnl_act_append() does not clone the object, it takes it over
and thus the source object is destroyed.
---

diff --git a/lib/route/cls/mall.c b/lib/route/cls/mall.c
index d1588f6..e13ee92 100644
--- a/lib/route/cls/mall.c
+++ b/lib/route/cls/mall.c
@@ -225,25 +225,29 @@ static int mall_msg_fill(struct rtnl_tc *tc, void *data, struct nl_msg *msg)
 static int mall_clone(void *_dst, void *_src)
 {
 	struct rtnl_mall *dst = _dst, *src = _src;
-	struct rtnl_act *next;
+	struct rtnl_act *next, *new;
 	int err;
 
 	if (src->m_act) {
 		if (!(dst->m_act = rtnl_act_alloc()))
 			return -NLE_NOMEM;
 
+		/* action nl list next and prev pointers must be updated */
+		nl_init_list_head(&dst->m_act->ce_list);
+
 		memcpy(dst->m_act, src->m_act, sizeof(struct rtnl_act));
 		next = rtnl_act_next(src->m_act);
 		while (next) {
-		        err = rtnl_act_append(&dst->m_act, next);
+			new = (struct rtnl_act *) nl_object_clone((struct nl_object *) next);
+			if (!new)
+				return -NLE_NOMEM;
+
+			err = rtnl_act_append(&dst->m_act, new);
 			if (err < 0)
-		                return err;
+				return err;
 
 			next = rtnl_act_next(next);
 		}
-
-		/* action nl list next and prev pointers must be updated */
-		nl_init_list_head(&dst->m_act->ce_list);
 	}
 
 	return 0;