selftests/bpf: xdp_hw_metadata cleanup cause segfault
authorJesper Dangaard Brouer <brouer@redhat.com>
Wed, 1 Feb 2023 17:31:55 +0000 (18:31 +0100)
committerDaniel Borkmann <daniel@iogearbox.net>
Wed, 1 Feb 2023 23:48:22 +0000 (00:48 +0100)
commita19a62e56478ba4afadfa7df94d0819542b7ccf8
treeb43ad6e16ea734f7cb1bcd93b46752097900fdba
parent3fd9dcd689a5582e682fde57b3139066d032367a
selftests/bpf: xdp_hw_metadata cleanup cause segfault

Using xdp_hw_metadata I experince Segmentation fault after seeing
"detaching bpf program....".

On my system the segfault happened when accessing bpf_obj->skeleton
in xdp_hw_metadata__destroy(bpf_obj) call. That doesn't make any sense
as this memory have not been freed by program at this point in time.

Prior to calling xdp_hw_metadata__destroy(bpf_obj) the function
close_xsk() is called for each RX-queue xsk.  The real bug lays
in close_xsk() that unmap via munmap() the wrong memory pointer.
The call xsk_umem__delete(xsk->umem) will free xsk->umem, thus
the call to munmap(xsk->umem, UMEM_SIZE) will have unpredictable
behavior. And man page explain subsequent references to these
pages will generate SIGSEGV.

Unmapping xsk->umem_area instead removes the segfault.

Fixes: 297a3f124155 ("selftests/bpf: Simple program to dump XDP RX metadata")
Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Stanislav Fomichev <sdf@google.com>
Link: https://lore.kernel.org/bpf/167527271533.937063.5717065138099679142.stgit@firesoul
tools/testing/selftests/bpf/xdp_hw_metadata.c