From patchwork Tue Nov 3 09:41:29 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Magnus Karlsson X-Patchwork-Id: 1392745 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=23.128.96.18; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20161025 header.b=Wb8hatPj; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by ozlabs.org (Postfix) with ESMTP id 4CQPvF57c3z9sSs for ; Tue, 3 Nov 2020 20:42:01 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727282AbgKCJmB (ORCPT ); Tue, 3 Nov 2020 04:42:01 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58510 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725988AbgKCJmA (ORCPT ); Tue, 3 Nov 2020 04:42:00 -0500 Received: from mail-pf1-x443.google.com (mail-pf1-x443.google.com [IPv6:2607:f8b0:4864:20::443]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1EDF0C0613D1; Tue, 3 Nov 2020 01:42:00 -0800 (PST) Received: by mail-pf1-x443.google.com with SMTP id x13so13693760pfa.9; Tue, 03 Nov 2020 01:42:00 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=RR2ou0XaLONx8HGAyVgzdLv71+3qXys+12Mmi6OmFu0=; b=Wb8hatPjgcVMBpdVaygeV1t4mwkRBAy/nPd5NC0gSladxsQH1BeyqQs75a9SUxTgw0 EkkGkKJRhLSUDAwc7FG8CpX9Y32lhYBLnMlI7V5npOOS3nIeyZNz5mjOV97ZRD034mSA zV+e3/jRZlwB6jPshTSP7Q6/+RFktAgwDBAtPg1Kr2Ln3WsPhcIePOaW8W2aNZn8saCP MqL6bgM9zCTNAggSJMEcgevvh97MNywBuHM0tyPs52/v4cAASLty6/ez+X4Acymyg2cy AZjQqybBKi51zsmPWrJV3BKGOKQs1iZFAc+YsVtIflNtCO0Kpzs54o2D0ZIfE0lLXfS7 xn4g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=RR2ou0XaLONx8HGAyVgzdLv71+3qXys+12Mmi6OmFu0=; b=XBncHvvJxFAgYvk47JBbtgtjWk81voDYP2grsL/nhNldYEUVxOEUw0iRPxAf0APwaW ZuEshF56FcHYcE18GsdCvVOeUVAsTj0IUSN95uqT2IxPiK1lZv53hcrtDxKarVmTMt9d /vQYf6NVZ9AwEeQ3iBiGNtGmKcqnFxY8IC2gfci5uh00PJ+iqFTPdvbSgge5hSUWtQJR 0oGk34HsZtXoqakpDeC5Y4wgyPC5EhFhNFG2Yxia8RPBV8d62TJwSPHSJcY//BnJPTlu StpfzZwe89Gsk6ansKWQEOwNvNpn8Kh2ZechfZQv4nRazHLT37tu9erdV/W27Ca6gyqa do6A== X-Gm-Message-State: AOAM5332loufsuLLKGE1EU1hxLRYfaRt6ifd5Jx/EYz9Ura5pTTcxS0h PpQni2l1tYrZBfPe7G87Yr8= X-Google-Smtp-Source: ABdhPJzAGZ1TOpZwSC7uniw0OQCgbmEq7guZES25MRaNH7b2Y22dRXhScOq5sCdIP4cUtpP6SBb4+g== X-Received: by 2002:a17:90b:118b:: with SMTP id gk11mr1809470pjb.178.1604396519760; Tue, 03 Nov 2020 01:41:59 -0800 (PST) Received: from VM.ger.corp.intel.com ([192.55.55.41]) by smtp.gmail.com with ESMTPSA id b16sm16419842pfp.195.2020.11.03.01.41.56 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Tue, 03 Nov 2020 01:41:59 -0800 (PST) From: Magnus Karlsson To: magnus.karlsson@intel.com, bjorn.topel@intel.com, ast@kernel.org, daniel@iogearbox.net, netdev@vger.kernel.org, jonathan.lemon@gmail.com, andrii.nakryiko@gmail.com Cc: bpf@vger.kernel.org Subject: [PATCH bpf 1/2] libbpf: fix null dereference in xsk_socket__delete Date: Tue, 3 Nov 2020 10:41:29 +0100 Message-Id: <1604396490-12129-2-git-send-email-magnus.karlsson@gmail.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1604396490-12129-1-git-send-email-magnus.karlsson@gmail.com> References: <1604396490-12129-1-git-send-email-magnus.karlsson@gmail.com> Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: Magnus Karlsson Fix a possible null pointer dereference in xsk_socket__delete that will occur if a null pointer is fed into the function. Fixes: 2f6324a3937f ("libbpf: Support shared umems between queues and devices") Reported-by: Andrii Nakryiko Signed-off-by: Magnus Karlsson Acked-by: Andrii Nakryiko --- tools/lib/bpf/xsk.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tools/lib/bpf/xsk.c b/tools/lib/bpf/xsk.c index e3c98c0..504b7a8 100644 --- a/tools/lib/bpf/xsk.c +++ b/tools/lib/bpf/xsk.c @@ -891,13 +891,14 @@ int xsk_umem__delete(struct xsk_umem *umem) void xsk_socket__delete(struct xsk_socket *xsk) { size_t desc_sz = sizeof(struct xdp_desc); - struct xsk_ctx *ctx = xsk->ctx; struct xdp_mmap_offsets off; + struct xsk_ctx *ctx; int err; if (!xsk) return; + ctx = xsk->ctx; if (ctx->prog_fd != -1) { xsk_delete_bpf_maps(xsk); close(ctx->prog_fd); From patchwork Tue Nov 3 09:41:30 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Magnus Karlsson X-Patchwork-Id: 1392746 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=23.128.96.18; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20161025 header.b=uGd/g3zE; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by ozlabs.org (Postfix) with ESMTP id 4CQPvK3BNJz9sSs for ; Tue, 3 Nov 2020 20:42:05 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727716AbgKCJmE (ORCPT ); Tue, 3 Nov 2020 04:42:04 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58518 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725988AbgKCJmD (ORCPT ); Tue, 3 Nov 2020 04:42:03 -0500 Received: from mail-pg1-x544.google.com (mail-pg1-x544.google.com [IPv6:2607:f8b0:4864:20::544]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 935D8C0613D1; Tue, 3 Nov 2020 01:42:03 -0800 (PST) Received: by mail-pg1-x544.google.com with SMTP id u4so1434546pgr.9; Tue, 03 Nov 2020 01:42:03 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=QgdmBtK50ARRJSPrtBkv/wghdRQJfGjFSSE7r68TMXo=; b=uGd/g3zERM5x8FvdUYNHkQC0NMam3gXJrYqFEinXAwhmsWvZoCGi84X4+lYxVHHo/0 uFU8A9lZXjrCMuBzubvaWcTRLVd/LWU/QcOKM0rR6xDw+J+LodWmRYVLwRHODNL76VHA FfTxXpSMIhO8BoyTxLpkmMTS0x66EdklLq9qhv8wkgWFfcHa1E9HkLcjmfCfCjI7P/Ns +J5ePLOEQOMg6viwUfhVMBWmwlUFnqUu4bYekKxg/U3qNrhuLWfNdSA4omtnoIn7CIZ/ 4EaffbUHIPV/ZlRuHI0ZGXYUaZsg4jL++JyUlLdEsxaQx4wIFsxGG1owt5fl6DRhRsr3 /Aew== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=QgdmBtK50ARRJSPrtBkv/wghdRQJfGjFSSE7r68TMXo=; b=pQJ/X2pzjwmxPFz8Z2WmcEfvZkB56Gpj8GDuC/QMTIWnOxLimryaqCDtY4rXg+OVcd dySoUAQDb4bt1k+GHmAJkiZKYrj9nVIO6GFz5pqyV8BIqRzcxFqOGe+Cy1a62jxdZyQB ykd/qQay+BV0xk9uUJ6FwKuQC0buDQ2NFGTOmrMYLjHfNrGZTB6IkhDsBgnV/w3lkiJ8 P4iiBxyrBT0KG2iiCPTWKGcwXpOWJA5MYVEDNRv5WLzSR4jG9TMMIiIpZzzemwx+cEPe KPUKhheH6THkGLUZLPVPgySMxRkxJ6vjDqNt8GywRD/7YPJ34SLiuwozY+fBSsSQvlJ8 woCw== X-Gm-Message-State: AOAM530wMsAtkN0wgMXz+ZH2Ye+QlFIymIbJjAX7/xLvNT9rTkrHa5G+ FvNk4sgrEHSz7ACIyRmdWyiFPvOuZ4h0vSWsRQM= X-Google-Smtp-Source: ABdhPJw+Eoux9JaAimukJ1FRcD6PeZipQMzCPWkFDOGS9qBfUu6ZU7j3+GqxSA+Djd4kpCS6aga42A== X-Received: by 2002:a17:90a:5a4e:: with SMTP id m14mr3022170pji.69.1604396523218; Tue, 03 Nov 2020 01:42:03 -0800 (PST) Received: from VM.ger.corp.intel.com ([192.55.55.41]) by smtp.gmail.com with ESMTPSA id b16sm16419842pfp.195.2020.11.03.01.42.00 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Tue, 03 Nov 2020 01:42:02 -0800 (PST) From: Magnus Karlsson To: magnus.karlsson@intel.com, bjorn.topel@intel.com, ast@kernel.org, daniel@iogearbox.net, netdev@vger.kernel.org, jonathan.lemon@gmail.com, andrii.nakryiko@gmail.com Cc: bpf@vger.kernel.org Subject: [PATCH bpf 2/2] libbpf: fix possible use after free in xsk_socket__delete Date: Tue, 3 Nov 2020 10:41:30 +0100 Message-Id: <1604396490-12129-3-git-send-email-magnus.karlsson@gmail.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1604396490-12129-1-git-send-email-magnus.karlsson@gmail.com> References: <1604396490-12129-1-git-send-email-magnus.karlsson@gmail.com> Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: Magnus Karlsson Fix a possible use after free in xsk_socket__delete that will happen if xsk_put_ctx() frees the ctx. To fix, save the umem reference taken from the context and just use that instead. Fixes: 2f6324a3937f ("libbpf: Support shared umems between queues and devices") Signed-off-by: Magnus Karlsson Acked-by: Andrii Nakryiko --- tools/lib/bpf/xsk.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/tools/lib/bpf/xsk.c b/tools/lib/bpf/xsk.c index 504b7a8..9bc537d 100644 --- a/tools/lib/bpf/xsk.c +++ b/tools/lib/bpf/xsk.c @@ -892,6 +892,7 @@ void xsk_socket__delete(struct xsk_socket *xsk) { size_t desc_sz = sizeof(struct xdp_desc); struct xdp_mmap_offsets off; + struct xsk_umem *umem; struct xsk_ctx *ctx; int err; @@ -899,6 +900,7 @@ void xsk_socket__delete(struct xsk_socket *xsk) return; ctx = xsk->ctx; + umem = ctx->umem; if (ctx->prog_fd != -1) { xsk_delete_bpf_maps(xsk); close(ctx->prog_fd); @@ -918,11 +920,11 @@ void xsk_socket__delete(struct xsk_socket *xsk) xsk_put_ctx(ctx); - ctx->umem->refcount--; + umem->refcount--; /* Do not close an fd that also has an associated umem connected * to it. */ - if (xsk->fd != ctx->umem->fd) + if (xsk->fd != umem->fd) close(xsk->fd); free(xsk); }