From patchwork Thu Jan 5 14:33:35 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Player, Timmons" X-Patchwork-Id: 18919 X-Patchwork-Delegate: ferruh.yigit@amd.com Return-Path: X-Original-To: patchwork@dpdk.org Delivered-To: patchwork@dpdk.org Received: from [92.243.14.124] (localhost [IPv6:::1]) by dpdk.org (Postfix) with ESMTP id 1F8E7D4E0; Thu, 5 Jan 2017 15:33:53 +0100 (CET) Received: from relay5-d.mail.gandi.net (relay5-d.mail.gandi.net [217.70.183.197]) by dpdk.org (Postfix) with ESMTP id 2D0685A44 for ; Thu, 5 Jan 2017 15:33:50 +0100 (CET) Received: from mfilter37-d.gandi.net (mfilter37-d.gandi.net [217.70.178.168]) by relay5-d.mail.gandi.net (Postfix) with ESMTP id DD07241C0A0; Thu, 5 Jan 2017 15:33:50 +0100 (CET) X-Virus-Scanned: Debian amavisd-new at mfilter37-d.gandi.net Received: from relay5-d.mail.gandi.net ([IPv6:::ffff:217.70.183.197]) by mfilter37-d.gandi.net (mfilter37-d.gandi.net [::ffff:10.0.15.180]) (amavisd-new, port 10024) with ESMTP id oXQX_fh8wSxu; Thu, 5 Jan 2017 15:33:46 +0100 (CET) X-Originating-IP: 99.127.244.244 Received: from smtprelay.monkeyplayground.net (99-127-244-244.lightspeed.rlghnc.sbcglobal.net [99.127.244.244]) (Authenticated sender: smtpauth@monkeyplayground.net) by relay5-d.mail.gandi.net (Postfix) with ESMTPSA id DDF2141C09F; Thu, 5 Jan 2017 15:33:45 +0100 (CET) Received: from sharon-apple.monkeyplayground.net (sharon-apple.monkeyplayground.net [192.168.254.13]) by smtprelay.monkeyplayground.net (Postfix) with ESMTPS id 2AD7510A4; Thu, 5 Jan 2017 09:33:43 -0500 (EST) Received: from localhost (localhost [127.0.0.1]) by sharon-apple.monkeyplayground.net (Postfix) with ESMTP id E98D2357F152; Thu, 5 Jan 2017 09:33:42 -0500 (EST) X-Virus-Scanned: amavisd-new at mydomain = monkeyplayground.net Received: from sharon-apple.monkeyplayground.net ([127.0.0.1]) by localhost (sharon-apple.monkeyplayground.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vFj3xwBRSIpe; Thu, 5 Jan 2017 09:33:42 -0500 (EST) Received: from rtp-skink.ad.spirentcom.com (rtpc2qlh02gf69y.monkeyplayground.net [192.168.254.64]) by sharon-apple.monkeyplayground.net (Postfix) with ESMTPSA id 64AC4357F148; Thu, 5 Jan 2017 09:33:42 -0500 (EST) From: "Timmons C. Player" To: linville@tuxdriver.com Cc: dev@dpdk.org, "Timmons C. Player" Date: Thu, 5 Jan 2017 09:33:35 -0500 Message-Id: <1483626815-476-1-git-send-email-timmons.player@spirent.com> X-Mailer: git-send-email 2.7.4 Subject: [dpdk-dev] [PATCH] net/af_packet: fix fd use after free X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" When using the same file descriptor for both rx and tx, the eth_dev_stop function would close the same fd twice. This change prevents that from happening. Signed-off-by: Timmons C. Player Acked-by: Ferruh Yigit --- drivers/net/af_packet/rte_eth_af_packet.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/drivers/net/af_packet/rte_eth_af_packet.c b/drivers/net/af_packet/rte_eth_af_packet.c index 2951f86..c44b8b9 100644 --- a/drivers/net/af_packet/rte_eth_af_packet.c +++ b/drivers/net/af_packet/rte_eth_af_packet.c @@ -261,9 +261,16 @@ eth_dev_stop(struct rte_eth_dev *dev) sockfd = internals->rx_queue[i].sockfd; if (sockfd != -1) close(sockfd); - sockfd = internals->tx_queue[i].sockfd; - if (sockfd != -1) - close(sockfd); + + /* Prevent use after free in case tx fd == rx fd */ + if (sockfd != internals->tx_queue[i].sockfd) { + sockfd = internals->tx_queue[i].sockfd; + if (sockfd != -1) + close(sockfd); + } + + internals->rx_queue[i].sockfd = -1; + internals->tx_queue[i].sockfd = -1; } dev->data->dev_link.link_status = ETH_LINK_DOWN;