netdev - Re: [PATCH bpf-next] selftests/xsk: fix double free

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <9d828483-21d0-18da-0870-babcb50d5c03@linux.dev>
Date:   Thu, 29 Sep 2022 17:52:22 -0700
From:   Martin KaFai Lau <martin.lau@...ux.dev>
To:     Maciej Fijalkowski <maciej.fijalkowski@...el.com>,
        Magnus Karlsson <magnus.karlsson@...il.com>
Cc:     magnus.karlsson@...el.com, bjorn@...nel.org, ast@...nel.org,
        daniel@...earbox.net, netdev@...r.kernel.org,
        jonathan.lemon@...il.com, bpf@...r.kernel.org
Subject: Re: [PATCH bpf-next] selftests/xsk: fix double free

On 9/29/22 3:44 AM, Maciej Fijalkowski wrote:
> On Thu, Sep 29, 2022 at 11:01:33AM +0200, Magnus Karlsson wrote:
>> From: Magnus Karlsson <magnus.karlsson@...el.com>
>>
>> Fix a double free at exit of the test suite.
>>
>> Fixes: a693ff3ed561 ("selftests/xsk: Add support for executing tests on physical device")
>> Signed-off-by: Magnus Karlsson <magnus.karlsson@...el.com>
>> ---
>>   tools/testing/selftests/bpf/xskxceiver.c | 3 ---
>>   1 file changed, 3 deletions(-)
>>
>> diff --git a/tools/testing/selftests/bpf/xskxceiver.c b/tools/testing/selftests/bpf/xskxceiver.c
>> index ef33309bbe49..d1a5f3218c34 100644
>> --- a/tools/testing/selftests/bpf/xskxceiver.c
>> +++ b/tools/testing/selftests/bpf/xskxceiver.c
>> @@ -1953,9 +1953,6 @@ int main(int argc, char **argv)
>>   
>>   	pkt_stream_delete(tx_pkt_stream_default);
>>   	pkt_stream_delete(rx_pkt_stream_default);
>> -	free(ifobj_rx->umem);
>> -	if (!ifobj_tx->shared_umem)
shared_umem means ifobj_rx->umem and ifobj_tx->umem are the same?  No special 
handling is needed and ifobject_delete() will handle it?

>> -		free(ifobj_tx->umem);
>>   	ifobject_delete(ifobj_tx);
>>   	ifobject_delete(ifobj_rx);
> 
> So basically we free this inside ifobject_delete().