selftests/xsk: Avoid use-after-free on ctx

The put lowers the reference count to 0 and frees ctx, reading it
afterwards is invalid. Move the put after the uses and determine the
last use by the reference count being 1.

Fixes: 39e940d4abfa ("selftests/xsk: Destroy BPF resources only when ctx refcount drops to 0")
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Magnus Karlsson <magnus.karlsson@intel.com>
Link: https://lore.kernel.org/bpf/20220901202645.1463552-1-irogers@google.com

diff --git a/tools/testing/selftests/bpf/xsk.c b/tools/testing/selftests/bpf/xsk.c
index f2721a4ae7c505f942f869342300b51c95004746..0b3ff49c740d455c5101f15d3ec2ea25e3096bae 100644 (file)
--- a/tools/testing/selftests/bpf/xsk.c
+++ b/tools/testing/selftests/bpf/xsk.c
@@ -1237,15 +1237,15 @@ void xsk_socket__delete(struct xsk_socket *xsk)
        ctx = xsk->ctx;
        umem = ctx->umem;
 
-       xsk_put_ctx(ctx, true);
-
-       if (!ctx->refcount) {
+       if (ctx->refcount == 1) {
                xsk_delete_bpf_maps(xsk);
                close(ctx->prog_fd);
                if (ctx->has_bpf_link)
                        close(ctx->link_fd);
        }
 
+       xsk_put_ctx(ctx, true);
+
        err = xsk_get_mmap_offsets(xsk->fd, &off);
        if (!err) {
                if (xsk->rx) {