[v1] selftests/bpf: Fixes for userspace ASAN

[PATCH bpf-next v1 08/14] selftests/bpf: Fix use-after-free in xdp_metadata test

Posted by Ihor Solodrai 1 month, 2 weeks ago

ASAN reported a use-after-free in close_xsk().

The xsk->socket internally references xsk->umem via socket->ctx->umem,
so the socket must be deleted before the umem. Fix the order of
operations in close_xsk().

Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
---
 tools/testing/selftests/bpf/prog_tests/xdp_metadata.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/bpf/prog_tests/xdp_metadata.c b/tools/testing/selftests/bpf/prog_tests/xdp_metadata.c
index 19f92affc2da..5c31054ad4a4 100644
--- a/tools/testing/selftests/bpf/prog_tests/xdp_metadata.c
+++ b/tools/testing/selftests/bpf/prog_tests/xdp_metadata.c
@@ -126,10 +126,10 @@ static int open_xsk(int ifindex, struct xsk *xsk)
 
 static void close_xsk(struct xsk *xsk)
 {
-	if (xsk->umem)
-		xsk_umem__delete(xsk->umem);
 	if (xsk->socket)
 		xsk_socket__delete(xsk->socket);
+	if (xsk->umem)
+		xsk_umem__delete(xsk->umem);
 	munmap(xsk->umem_area, UMEM_SIZE);
 }
 
-- 
2.53.0

Re: [PATCH bpf-next v1 08/14] selftests/bpf: Fix use-after-free in xdp_metadata test

Posted by Mykyta Yatsenko 1 month, 2 weeks ago

On 2/12/26 01:13, Ihor Solodrai wrote:
> ASAN reported a use-after-free in close_xsk().
>
> The xsk->socket internally references xsk->umem via socket->ctx->umem,
> so the socket must be deleted before the umem. Fix the order of
> operations in close_xsk().
>
> Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
> ---
>   tools/testing/selftests/bpf/prog_tests/xdp_metadata.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/tools/testing/selftests/bpf/prog_tests/xdp_metadata.c b/tools/testing/selftests/bpf/prog_tests/xdp_metadata.c
> index 19f92affc2da..5c31054ad4a4 100644
> --- a/tools/testing/selftests/bpf/prog_tests/xdp_metadata.c
> +++ b/tools/testing/selftests/bpf/prog_tests/xdp_metadata.c
> @@ -126,10 +126,10 @@ static int open_xsk(int ifindex, struct xsk *xsk)
>   
>   static void close_xsk(struct xsk *xsk)
>   {
> -	if (xsk->umem)
> -		xsk_umem__delete(xsk->umem);
>   	if (xsk->socket)
>   		xsk_socket__delete(xsk->socket);
> +	if (xsk->umem)
> +		xsk_umem__delete(xsk->umem);
>   	munmap(xsk->umem_area, UMEM_SIZE);
>   }
>   

xsk_umem__delete() is indeed referencing umem, the change makes sense.
Acked-by: Mykyta Yatsenko <yatsenko@meta.com>