libbpf: Fix possible use after free in xsk_socket__delete
authorMagnus Karlsson <magnus.karlsson@intel.com>
Tue, 3 Nov 2020 09:41:30 +0000 (10:41 +0100)
committerDaniel Borkmann <daniel@iogearbox.net>
Wed, 4 Nov 2020 20:37:29 +0000 (21:37 +0100)
commit25cf73b9ff88fd4608699a0313f820758b4c252d
tree5159c3cd3c814ba59c3f19ec4ed4ebc157153cb2
parentf78331f74cacb33d87cd60376dacc5bd397959e2
libbpf: Fix possible use after free in xsk_socket__delete

Fix a possible use after free in xsk_socket__delete that will happen
if xsk_put_ctx() frees the ctx. To fix, save the umem reference taken
from the context and just use that instead.

Fixes: 2f6324a3937f ("libbpf: Support shared umems between queues and devices")
Signed-off-by: Magnus Karlsson <magnus.karlsson@intel.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/1604396490-12129-3-git-send-email-magnus.karlsson@gmail.com
tools/lib/bpf/xsk.c