Skip to content

Commit f7ac552

Browse files
theihorAlexei Starovoitov
authored andcommitted
selftests/bpf: Fix use-after-free in xdp_metadata test
ASAN reported a use-after-free in close_xsk(). The xsk->socket internally references xsk->umem via socket->ctx->umem, so the socket must be deleted before the umem. Fix the order of operations in close_xsk(). Acked-by: Mykyta Yatsenko <yatsenko@meta.com> Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev> Link: https://lore.kernel.org/r/20260223190736.649171-14-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov <ast@kernel.org>
1 parent ff95114 commit f7ac552

1 file changed

Lines changed: 2 additions & 2 deletions

File tree

tools/testing/selftests/bpf/prog_tests/xdp_metadata.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -126,10 +126,10 @@ static int open_xsk(int ifindex, struct xsk *xsk)
126126

127127
static void close_xsk(struct xsk *xsk)
128128
{
129-
if (xsk->umem)
130-
xsk_umem__delete(xsk->umem);
131129
if (xsk->socket)
132130
xsk_socket__delete(xsk->socket);
131+
if (xsk->umem)
132+
xsk_umem__delete(xsk->umem);
133133
munmap(xsk->umem_area, UMEM_SIZE);
134134
}
135135

0 commit comments

Comments
 (0)