libbpf: Fix possible use after free in xsk_socket__delete (25cf73b9) · Commits · 戴 / test

Fix a possible use after free in xsk_socket__delete that will happen if xsk_put_ctx() frees the ctx. To fix, save the umem reference taken from the context and just use that instead. Fixes: ("libbpf: Support shared umems between queues and devices") Signed-off-by:

Magnus Karlsson <magnus.karlsson@intel.com> Signed-off-by:

Daniel Borkmann <daniel@iogearbox.net> Acked-by:

Andrii Nakryiko <andrii@kernel.org> Link: https://lore.kernel.org/bpf/1604396490-12129-3-git-send-email-magnus.karlsson@gmail.com

tools/lib/bpf/xsk.c

+4 −2

Original line number	Diff line number	Diff line
		@@ -892,6 +892,7 @@ void xsk_socket__delete(struct xsk_socket *xsk)
		{
		size_t desc_sz = sizeof(struct xdp_desc);
		struct xdp_mmap_offsets off;
		struct xsk_umem *umem;
		struct xsk_ctx *ctx;
		int err;

		@@ -899,6 +900,7 @@ void xsk_socket__delete(struct xsk_socket *xsk)
		return;

		ctx = xsk->ctx;
		umem = ctx->umem;
		if (ctx->prog_fd != -1) {
		xsk_delete_bpf_maps(xsk);
		close(ctx->prog_fd);
		@@ -918,11 +920,11 @@ void xsk_socket__delete(struct xsk_socket *xsk)

		xsk_put_ctx(ctx);

		ctx->umem->refcount--;
		umem->refcount--;
		/* Do not close an fd that also has an associated umem connected
		* to it.
		*/
		if (xsk->fd != ctx->umem->fd)
		if (xsk->fd != umem->fd)
		close(xsk->fd);
		free(xsk);
		}

Admin message