]> git.proxmox.com Git - mirror_ubuntu-jammy-kernel.git/commit - net/xdp/xsk.c
xsk: Fix use-after-free in failed shared_umem bind
authorMagnus Karlsson <magnus.karlsson@intel.com>
Wed, 2 Sep 2020 07:36:04 +0000 (09:36 +0200)
committerDaniel Borkmann <daniel@iogearbox.net>
Wed, 2 Sep 2020 21:37:19 +0000 (23:37 +0200)
commit83cf5c68d663fc78ce529c41bf24f9f6be88bef4
tree01b95b3eb5bb1654b9eb7f13ed425f2f5b1db5cf
parent1d6fd78a213ee3874f46bdce083b7a41d208886d
xsk: Fix use-after-free in failed shared_umem bind

Fix use-after-free when a shared umem bind fails. The code incorrectly
tried to free the allocated buffer pool both in the bind code and then
later also when the socket was released. Fix this by setting the
buffer pool pointer to NULL after the bind code has freed the pool, so
that the socket release code will not try to free the pool. This is
the same solution as the regular, non-shared umem code path has. This
was missing from the shared umem path.

Fixes: b5aea28dca13 ("xsk: Add shared umem support between queue ids")
Reported-by: syzbot+5334f62e4d22804e646a@syzkaller.appspotmail.com
Signed-off-by: Magnus Karlsson <magnus.karlsson@intel.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/1599032164-25684-1-git-send-email-magnus.karlsson@intel.com
net/xdp/xsk.c