libbpf: Fix possible use after free in xsk_socket__delete

Fix a possible use after free in xsk_socket__delete that will happen
if xsk_put_ctx() frees the ctx. To fix, save the umem reference taken
from the context and just use that instead.

Fixes: 2f6324a3937f ("libbpf: Support shared umems between queues and devices")
Signed-off-by: Magnus Karlsson <magnus.karlsson@intel.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/1604396490-12129-3-git-send-email-magnus.karlsson@gmail.com

diff --git a/tools/lib/bpf/xsk.c b/tools/lib/bpf/xsk.c
index 504b7a85d4456760a83302de97d3c98ff5e80d76..9bc537d0b92da7953c409e5e5bb08f8d21baf361 100644 (file)
--- a/tools/lib/bpf/xsk.c
+++ b/tools/lib/bpf/xsk.c
@@ -892,6 +892,7 @@ void xsk_socket__delete(struct xsk_socket *xsk)
 {
        size_t desc_sz = sizeof(struct xdp_desc);
        struct xdp_mmap_offsets off;
+       struct xsk_umem *umem;
        struct xsk_ctx *ctx;
        int err;
 
@@ -899,6 +900,7 @@ void xsk_socket__delete(struct xsk_socket *xsk)
                return;
 
        ctx = xsk->ctx;
+       umem = ctx->umem;
        if (ctx->prog_fd != -1) {
                xsk_delete_bpf_maps(xsk);
                close(ctx->prog_fd);
@@ -918,11 +920,11 @@ void xsk_socket__delete(struct xsk_socket *xsk)
 
        xsk_put_ctx(ctx);
 
-       ctx->umem->refcount--;
+       umem->refcount--;
        /* Do not close an fd that also has an associated umem connected
         * to it.
         */
-       if (xsk->fd != ctx->umem->fd)
+       if (xsk->fd != umem->fd)
                close(xsk->fd);
        free(xsk);
 }