selftests/xsk: Avoid use-after-free on ctx

[ Upstream commit af515a5587b8f45f19e11657746e0c89411b0380 ]

The put lowers the reference count to 0 and frees ctx, reading it
afterwards is invalid. Move the put after the uses and determine the
last use by the reference count being 1.

Fixes: 39e940d4abfa ("selftests/xsk: Destroy BPF resources only when ctx refcount drops to 0")
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Magnus Karlsson <magnus.karlsson@intel.com>
Link: https://lore.kernel.org/bpf/20220901202645.1463552-1-irogers@google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/tools/lib/bpf/xsk.c b/tools/lib/bpf/xsk.c
index 42b8437..2be3197 100644 (file)
--- a/tools/lib/bpf/xsk.c
+++ b/tools/lib/bpf/xsk.c
@@ -1245,15 +1245,15 @@ void xsk_socket__delete(struct xsk_socket *xsk)
        ctx = xsk->ctx;
        umem = ctx->umem;
 
-       xsk_put_ctx(ctx, true);
-
-       if (!ctx->refcount) {
+       if (ctx->refcount == 1) {
                xsk_delete_bpf_maps(xsk);
                close(ctx->prog_fd);
                if (ctx->has_bpf_link)
                        close(ctx->link_fd);
        }
 
+       xsk_put_ctx(ctx, true);
+
        err = xsk_get_mmap_offsets(xsk->fd, &off);
        if (!err) {
                if (xsk->rx) {