From: Ihor Solodrai <ihor.solodrai@linux.dev>
To: "Alexei Starovoitov" <ast@kernel.org>,
"Andrii Nakryiko" <andrii@kernel.org>,
"Daniel Borkmann" <daniel@iogearbox.net>,
"Eduard Zingerman" <eddyz87@gmail.com>,
"Jiri Olsa" <olsajiri@gmail.com>,
"Mykyta Yatsenko" <yatsenko@meta.com>,
"Alexis Lothoré" <alexis.lothore@bootlin.com>
Cc: Amery Hung <ameryhung@gmail.com>,
bpf@vger.kernel.org, linux-kernel@vger.kernel.org,
kernel-team@meta.com
Subject: [PATCH bpf v4 13/20] selftests/bpf: Fix use-after-free in xdp_metadata test
Date: Mon, 23 Feb 2026 11:07:29 -0800 [thread overview]
Message-ID: <20260223190736.649171-14-ihor.solodrai@linux.dev> (raw)
In-Reply-To: <20260223190736.649171-1-ihor.solodrai@linux.dev>
ASAN reported a use-after-free in close_xsk().
The xsk->socket internally references xsk->umem via socket->ctx->umem,
so the socket must be deleted before the umem. Fix the order of
operations in close_xsk().
Acked-by: Mykyta Yatsenko <yatsenko@meta.com>
Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
---
tools/testing/selftests/bpf/prog_tests/xdp_metadata.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/testing/selftests/bpf/prog_tests/xdp_metadata.c b/tools/testing/selftests/bpf/prog_tests/xdp_metadata.c
index 19f92affc2da..5c31054ad4a4 100644
--- a/tools/testing/selftests/bpf/prog_tests/xdp_metadata.c
+++ b/tools/testing/selftests/bpf/prog_tests/xdp_metadata.c
@@ -126,10 +126,10 @@ static int open_xsk(int ifindex, struct xsk *xsk)
static void close_xsk(struct xsk *xsk)
{
- if (xsk->umem)
- xsk_umem__delete(xsk->umem);
if (xsk->socket)
xsk_socket__delete(xsk->socket);
+ if (xsk->umem)
+ xsk_umem__delete(xsk->umem);
munmap(xsk->umem_area, UMEM_SIZE);
}
--
2.53.0
next prev parent reply other threads:[~2026-02-23 19:08 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-02-23 19:07 [PATCH bpf v4 00/20] selftests/bpf: Fixes for userspace ASAN Ihor Solodrai
2026-02-23 19:07 ` [PATCH bpf v4 01/20] selftests/bpf: Add simple strscpy() implementation Ihor Solodrai
2026-02-23 19:07 ` [PATCH bpf v4 02/20] selftests/bpf: Replace strcpy() calls with strscpy() Ihor Solodrai
2026-02-23 19:07 ` [PATCH bpf v4 03/20] selftests/bpf: Replace strncpy() " Ihor Solodrai
2026-02-23 22:28 ` Eduard Zingerman
2026-02-23 22:32 ` Ihor Solodrai
2026-02-23 22:59 ` Eduard Zingerman
2026-02-23 19:07 ` [PATCH bpf v4 04/20] selftests/bpf: Use strscpy in bpftool_helpers.c Ihor Solodrai
2026-02-23 19:07 ` [PATCH bpf v4 05/20] selftests/bpf: Use memcpy() for bounded non-NULL-terminated copies Ihor Solodrai
2026-02-23 19:07 ` [PATCH bpf v4 06/20] selftests/bpf: Pass through build flags to bpftool and resolve_btfids Ihor Solodrai
2026-02-23 19:07 ` [PATCH bpf v4 07/20] resolve_btfids: Fix memory leaks reported by ASAN Ihor Solodrai
2026-02-23 19:07 ` [PATCH bpf v4 08/20] selftests/bpf: Add DENYLIST.asan Ihor Solodrai
2026-02-23 19:07 ` [PATCH bpf v4 09/20] selftests/bpf: Refactor bpf_get_ksyms() trace helper Ihor Solodrai
2026-02-23 23:23 ` Eduard Zingerman
2026-02-23 19:07 ` [PATCH bpf v4 10/20] selftests/bpf: Fix memory leaks in tests Ihor Solodrai
2026-02-23 19:07 ` [PATCH bpf v4 11/20] selftests/bpf: Fix cleanup in check_fd_array_cnt__fd_array_too_big() Ihor Solodrai
2026-02-23 19:07 ` [PATCH bpf v4 12/20] veristat: Fix a memory leak for preset ENUMERATOR Ihor Solodrai
2026-02-23 19:07 ` Ihor Solodrai [this message]
2026-02-23 19:07 ` [PATCH bpf v4 14/20] selftests/bpf: Fix double thread join in uprobe_multi_test Ihor Solodrai
2026-02-23 19:07 ` [PATCH bpf v4 15/20] selftests/bpf: Fix resource leaks caused by missing cleanups Ihor Solodrai
2026-02-23 19:07 ` [PATCH bpf v4 16/20] selftests/bpf: Free bpf_object in test_sysctl Ihor Solodrai
2026-02-23 19:07 ` [PATCH bpf v4 17/20] selftests/bpf: Fix array bounds warning in jit_disasm_helpers Ihor Solodrai
2026-02-23 19:11 ` [PATCH bpf v4 18/20] selftests/bpf: Fix out-of-bounds array access bugs reported by ASAN Ihor Solodrai
2026-02-23 19:11 ` [PATCH bpf v4 19/20] selftests/bpf: Check BPFTOOL env var in detect_bpftool_path() Ihor Solodrai
2026-02-23 19:11 ` [PATCH bpf v4 20/20] selftests/bpf: Don't override SIGSEGV handler with ASAN Ihor Solodrai
2026-02-24 3:00 ` [PATCH bpf v4 00/20] selftests/bpf: Fixes for userspace ASAN patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260223190736.649171-14-ihor.solodrai@linux.dev \
--to=ihor.solodrai@linux.dev \
--cc=alexis.lothore@bootlin.com \
--cc=ameryhung@gmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=eddyz87@gmail.com \
--cc=kernel-team@meta.com \
--cc=linux-kernel@vger.kernel.org \
--cc=olsajiri@gmail.com \
--cc=yatsenko@meta.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.