From fc2f56702d4bc7f2ad5a4f51b2fb4c7ea10187b2 Mon Sep 17 00:00:00 2001 From: Cory Snider Date: Wed, 29 Jul 2026 14:12:08 -0400 Subject: [PATCH] d/libn/i/nftables: reject Apply on a closed nft_ctx Close() frees the libnftables context and nils out the handle, so passing a closed nftCtx to Apply() would hand a nil pointer to libnftables and crash the daemon. No caller can do that today: table.nftApply() nil-checks its *nftCtx and creates a new context when it has been closed, and RunCmd() owns its context for the duration of a single call. Return an error anyway, rather than depending on every future caller to get the lifecycle right. Co-Authored-By: Claude Opus 5 Signed-off-by: Cory Snider --- daemon/libnetwork/internal/nftables/nft_cgo_linux.go | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/daemon/libnetwork/internal/nftables/nft_cgo_linux.go b/daemon/libnetwork/internal/nftables/nft_cgo_linux.go index 6674eb5855..04d4019bd9 100644 --- a/daemon/libnetwork/internal/nftables/nft_cgo_linux.go +++ b/daemon/libnetwork/internal/nftables/nft_cgo_linux.go @@ -35,6 +35,10 @@ type nftCtx struct { // Apply calls libnftables to execute the nftables commands in nftCmd. func (h *nftCtx) Apply(ctx context.Context, nftCmd []byte) error { + if h.handle == nil { + return errors.New("libnftables: context is closed") + } + ctx, span := otel.Tracer("").Start(ctx, spanPrefix+".nftApply.cgo") defer span.End()