| Message ID | 1599032164-25684-1-git-send-email-magnus.karlsson@intel.com |
|---|---|
| State | Accepted |
| Delegated to: | BPF Maintainers |
| Headers | show |
| Series | [bpf-next] xsk: fix use-after-free in failed shared_umem bind | expand |
On 9/2/20 9:36 AM, Magnus Karlsson wrote: > Fix use-after-free when a shared umem bind fails. The code incorrectly > tried to free the allocated buffer pool both in the bind code and then > later also when the socket was released. Fix this by setting the > buffer pool pointer to NULL after the bind code has freed the pool, so > that the socket release code will not try to free the pool. This is > the same solution as the regular, non-shared umem code path has. This > was missing from the shared umem path. > > Signed-off-by: Magnus Karlsson <magnus.karlsson@intel.com> > Reported-by: syzbot+5334f62e4d22804e646a@syzkaller.appspotmail.com > Fixes: b5aea28dca13 ("xsk: Add shared umem support between queue ids") Lgtm, applied, thanks!
diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c index 5eb6662..afd1ca0 100644 --- a/net/xdp/xsk.c +++ b/net/xdp/xsk.c @@ -717,6 +717,7 @@ static int xsk_bind(struct socket *sock, struct sockaddr *addr, int addr_len) dev, qid); if (err) { xp_destroy(xs->pool); + xs->pool = NULL; sockfd_put(sock); goto out_unlock; }
Fix use-after-free when a shared umem bind fails. The code incorrectly tried to free the allocated buffer pool both in the bind code and then later also when the socket was released. Fix this by setting the buffer pool pointer to NULL after the bind code has freed the pool, so that the socket release code will not try to free the pool. This is the same solution as the regular, non-shared umem code path has. This was missing from the shared umem path. Signed-off-by: Magnus Karlsson <magnus.karlsson@intel.com> Reported-by: syzbot+5334f62e4d22804e646a@syzkaller.appspotmail.com Fixes: b5aea28dca13 ("xsk: Add shared umem support between queue ids") --- net/xdp/xsk.c | 1 + 1 file changed, 1 insertion(+)