Commit 25cf73b9 authored by Magnus Karlsson's avatar Magnus Karlsson Committed by Daniel Borkmann
Browse files

libbpf: Fix possible use after free in xsk_socket__delete 



Fix a possible use after free in xsk_socket__delete that will happen
if xsk_put_ctx() frees the ctx. To fix, save the umem reference taken
from the context and just use that instead.

Fixes: 2f6324a3 ("libbpf: Support shared umems between queues and devices")
Signed-off-by: default avatarMagnus Karlsson <magnus.karlsson@intel.com>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Acked-by: default avatarAndrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/1604396490-12129-3-git-send-email-magnus.karlsson@gmail.com
parent f78331f7

tools/lib/bpf/xsk.c

+4 −2
Original line number Diff line number Diff line
@@ -892,6 +892,7 @@ void xsk_socket__delete(struct xsk_socket *xsk) 
{

	size_t desc_sz = sizeof(struct xdp_desc);

	struct xdp_mmap_offsets off;

	struct xsk_umem *umem;

	struct xsk_ctx *ctx;

	int err;
@@ -899,6 +900,7 @@ void xsk_socket__delete(struct xsk_socket *xsk) 
		return;



	ctx = xsk->ctx;

	umem = ctx->umem;

	if (ctx->prog_fd != -1) {

		xsk_delete_bpf_maps(xsk);

		close(ctx->prog_fd);
@@ -918,11 +920,11 @@ void xsk_socket__delete(struct xsk_socket *xsk) 


	xsk_put_ctx(ctx);



	ctx->umem->refcount--;

	umem->refcount--;

	/* Do not close an fd that also has an associated umem connected

	 * to it.

	 */

	if (xsk->fd != ctx->umem->fd)

	if (xsk->fd != umem->fd)

		close(xsk->fd);

	free(xsk);

}