net/af_packet: fix fd use after free

When using the same file descriptor for both rx and tx, the
eth_dev_stop function would close the same fd twice.   This
change prevents that from happening.

Fixes: 364e08f2bbc0 ("af_packet: add PMD for AF_PACKET-based virtual devices")

Signed-off-by: Timmons C. Player <timmons.player@spirent.com>
Acked-by: Ferruh Yigit <ferruh.yigit@intel.com>

diff --git a/drivers/net/af_packet/rte_eth_af_packet.c b/drivers/net/af_packet/rte_eth_af_packet.c
index 17b4ffe..ed24d38 100644 (file)
--- a/drivers/net/af_packet/rte_eth_af_packet.c
+++ b/drivers/net/af_packet/rte_eth_af_packet.c
@@ -267,9 +267,16 @@ eth_dev_stop(struct rte_eth_dev *dev)
                sockfd = internals->rx_queue[i].sockfd;
                if (sockfd != -1)
                        close(sockfd);
-               sockfd = internals->tx_queue[i].sockfd;
-               if (sockfd != -1)
-                       close(sockfd);
+
+               /* Prevent use after free in case tx fd == rx fd */
+               if (sockfd != internals->tx_queue[i].sockfd) {
+                       sockfd = internals->tx_queue[i].sockfd;
+                       if (sockfd != -1)
+                               close(sockfd);
+               }
+
+               internals->rx_queue[i].sockfd = -1;
+               internals->tx_queue[i].sockfd = -1;
        }
 
        dev->data->dev_link.link_status = ETH_LINK_DOWN;