Re: [PATCH bpf-next v1 08/14] selftests/bpf: Fix use-after-free in xdp_metadata test

[Mykyta Yatsenko]

On 2/12/26 01:13, Ihor Solodrai wrote:
> ASAN reported a use-after-free in close_xsk().
>
> The xsk->socket internally references xsk->umem via socket->ctx->umem,
> so the socket must be deleted before the umem. Fix the order of
> operations in close_xsk().
>
> Signed-off-by: Ihor Solodrai <ihor.solodrai@xxxxxxxxx>
> ---
>   tools/testing/selftests/bpf/prog_tests/xdp_metadata.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/tools/testing/selftests/bpf/prog_tests/xdp_metadata.c b/tools/testing/selftests/bpf/prog_tests/xdp_metadata.c
> index 19f92affc2da..5c31054ad4a4 100644
> --- a/tools/testing/selftests/bpf/prog_tests/xdp_metadata.c
> +++ b/tools/testing/selftests/bpf/prog_tests/xdp_metadata.c
> @@ -126,10 +126,10 @@ static int open_xsk(int ifindex, struct xsk *xsk)
>   
>   static void close_xsk(struct xsk *xsk)
>   {
> -	if (xsk->umem)
> -		xsk_umem__delete(xsk->umem);
>   	if (xsk->socket)
>   		xsk_socket__delete(xsk->socket);
> +	if (xsk->umem)
> +		xsk_umem__delete(xsk->umem);
>   	munmap(xsk->umem_area, UMEM_SIZE);
>   }
>   

xsk_umem__delete() is indeed referencing umem, the change makes sense.
Acked-by: Mykyta Yatsenko <yatsenko@xxxxxxxx>