From patchwork Thu Sep 1 20:26:45 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ian Rogers X-Patchwork-Id: 12963195 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5022BC6FA81 for ; Thu, 1 Sep 2022 20:26:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234931AbiIAU0x (ORCPT ); Thu, 1 Sep 2022 16:26:53 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39656 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234924AbiIAU0w (ORCPT ); Thu, 1 Sep 2022 16:26:52 -0400 Received: from mail-yb1-xb49.google.com (mail-yb1-xb49.google.com [IPv6:2607:f8b0:4864:20::b49]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E349176943 for ; Thu, 1 Sep 2022 13:26:50 -0700 (PDT) Received: by mail-yb1-xb49.google.com with SMTP id p12-20020a259e8c000000b006958480b858so207825ybq.12 for ; Thu, 01 Sep 2022 13:26:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=cc:to:from:subject:mime-version:message-id:date:from:to:cc:subject :date; bh=DkZMlYUjqvBBA8dctsqSfJSvv6sYsaMxoePCT/ImrrM=; b=sL0Crh6kUMn+rRD3i6lhoOHAXnPjqJ/X+vQBYX//7iNtMAYH5Gw8X8b5hzUI8nZx6x prYIYY7he1lyXa/j1SUotodLeEtBKZ8hszOFOxGTNsFGIpaR/adqzBGkTRfqYJtXFynL ej0YWcMOI68q8bd589d8LanYilkFraLZ4ZezrWKGH4sOJ5jVW0aypKBpEen4k91NtgBk XRBxQfLc4UpR7vP+O2QxFodZWWeR8SzCbD0hF+LwEXrSsXQLI+vA90FJC069ksDznfMo u5kHJNtbq+rUaGoIeNSQB9YMiwB0DaINvHxP86ynTr3WOJdmA1u++cRVYTBIPqhRB5GI sFdA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=cc:to:from:subject:mime-version:message-id:date:x-gm-message-state :from:to:cc:subject:date; bh=DkZMlYUjqvBBA8dctsqSfJSvv6sYsaMxoePCT/ImrrM=; b=XbbZC/YmCvYgDOqwbmXf2qzowR9FxxEVUz7EhVTW/X0qqiOxYjmmPwpZo/P/HU+ihL 9QPB07zYdVqNyJBsHEoJwT2C9THr7z4UYWK2Rs5UfzZzZxI/1qhYW7uybSNPMaV3Y2/H upd8iA8tVzvTMsbV70phHraoE7DNEbv2h30S3gWJZy5QBLvuDxcL1BHk/aJpK9XCdYg0 ds7fv7nrV1ZhjHT7JVIm3KDpeJSQt6oqzRANktYDxzzwD6K88CkVHqnrs53k8rCs7JTq UFUAHisQk9YNPAdak6GoYTMN1wOR7/L8H8j3icJmnVDJ2wtFRywD9OZZ0p2El6aUXT41 pZlg== X-Gm-Message-State: ACgBeo37JwFGycfyNp+mriGA0XXTYgXlzDJIy7Y8YXipN0b7YGQN2b4o wuPVGoRMxtmIu3LX7b+H7OIsYwhVKCRY X-Google-Smtp-Source: AA6agR4QSPvpvHPWxR+rBUJrmSkA/ubTu8FM3TjSIH8gCd0xPRRaROY61KaJb+a7gEIGMUe5luEOmUODdbpV X-Received: from irogers.svl.corp.google.com ([2620:15c:2d4:203:ef7b:b6fc:77d6:e782]) (user=irogers job=sendgmr) by 2002:a81:c241:0:b0:336:f5a6:2e36 with SMTP id t1-20020a81c241000000b00336f5a62e36mr25011273ywg.123.1662064010200; Thu, 01 Sep 2022 13:26:50 -0700 (PDT) Date: Thu, 1 Sep 2022 13:26:45 -0700 Message-Id: <20220901202645.1463552-1-irogers@google.com> Mime-Version: 1.0 X-Mailer: git-send-email 2.37.2.789.g6183377224-goog Subject: [PATCH v1] selftests/xsk: Avoid use-after-free on ctx From: Ian Rogers To: " =?utf-8?b?QmrDtnJuIFTDtnBlbA==?= " , Magnus Karlsson , Maciej Fijalkowski , Jonathan Lemon , Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Song Liu , Yonghong Song , John Fastabend , KP Singh , Stanislav Fomichev , Hao Luo , Jiri Olsa , Mykola Lysenko , Shuah Khan , netdev@vger.kernel.org, bpf@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Ian Rogers Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org X-Patchwork-Delegate: bpf@iogearbox.net The put lowers the reference count to 0 and frees ctx, reading it afterwards is invalid. Move the put after the uses and determine the last use by the reference count being 1. Fixes: 39e940d4abfa ("selftests/xsk: Destroy BPF resources only when ctx refcount drops to 0") Signed-off-by: Ian Rogers Acked-by: Magnus Karlsson --- tools/testing/selftests/bpf/xsk.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tools/testing/selftests/bpf/xsk.c b/tools/testing/selftests/bpf/xsk.c index f2721a4ae7c5..0b3ff49c740d 100644 --- a/tools/testing/selftests/bpf/xsk.c +++ b/tools/testing/selftests/bpf/xsk.c @@ -1237,15 +1237,15 @@ void xsk_socket__delete(struct xsk_socket *xsk) ctx = xsk->ctx; umem = ctx->umem; - xsk_put_ctx(ctx, true); - - if (!ctx->refcount) { + if (ctx->refcount == 1) { xsk_delete_bpf_maps(xsk); close(ctx->prog_fd); if (ctx->has_bpf_link) close(ctx->link_fd); } + xsk_put_ctx(ctx, true); + err = xsk_get_mmap_offsets(xsk->fd, &off); if (!err) { if (xsk->rx) {