mirror/libbpf
1
0
Fork 0
mirror of https://github.com/netdata/libbpf.git synced 2026-04-03 15:19:07 +08:00
Code Issues Packages Projects Releases Wiki Activity

libbpf: Fix possible use after free in xsk_socket__delete

Browse Source 
Fix a possible use after free in xsk_socket__delete that will happen
if xsk_put_ctx() frees the ctx. To fix, save the umem reference taken
from the context and just use that instead.

Fixes: 2f6324a3937f ("libbpf: Support shared umems between queues and devices")
Signed-off-by: Magnus Karlsson <magnus.karlsson@intel.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/1604396490-12129-3-git-send-email-magnus.karlsson@gmail.com
This commit is contained in:
Magnus Karlsson
2020-11-03 10:41:30 +01:00
committed by Andrii Nakryiko
parent 539aa6bea5
commit 8caff995c7
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/xsk.c
View File

@@ -892,6 +892,7 @@ void xsk_socket__delete(struct xsk_socket *xsk)
{ {
size_t desc_sz = sizeof(struct xdp_desc); size_t desc_sz = sizeof(struct xdp_desc);
struct xdp_mmap_offsets off; struct xdp_mmap_offsets off;
struct xsk_umem *umem;
struct xsk_ctx *ctx; struct xsk_ctx *ctx;
int err; int err;
@@ -899,6 +900,7 @@ void xsk_socket__delete(struct xsk_socket *xsk)
return; return;
ctx = xsk->ctx; ctx = xsk->ctx;
umem = ctx->umem;
if (ctx->prog_fd != -1) { if (ctx->prog_fd != -1) {
xsk_delete_bpf_maps(xsk); xsk_delete_bpf_maps(xsk);
close(ctx->prog_fd); close(ctx->prog_fd);
@@ -918,11 +920,11 @@ void xsk_socket__delete(struct xsk_socket *xsk)
xsk_put_ctx(ctx); xsk_put_ctx(ctx);
ctx->umem->refcount--; umem->refcount--;
/* Do not close an fd that also has an associated umem connected /* Do not close an fd that also has an associated umem connected
* to it. * to it.
*/ */
if (xsk->fd != ctx->umem->fd) if (xsk->fd != umem->fd)
close(xsk->fd); close(xsk->fd);
free(xsk); free(xsk);
} }