From 5d16a43c40cf2220c1b295307a00cee55d845633 Mon Sep 17 00:00:00 2001 From: "Timmons C. Player" Date: Thu, 5 Jan 2017 09:33:35 -0500 Subject: [PATCH] net/af_packet: fix fd use after free When using the same file descriptor for both rx and tx, the eth_dev_stop function would close the same fd twice. This change prevents that from happening. Fixes: 364e08f2bbc0 ("af_packet: add PMD for AF_PACKET-based virtual devices") Signed-off-by: Timmons C. Player Acked-by: Ferruh Yigit --- drivers/net/af_packet/rte_eth_af_packet.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/drivers/net/af_packet/rte_eth_af_packet.c b/drivers/net/af_packet/rte_eth_af_packet.c index 17b4ffec89..ed24d385a3 100644 --- a/drivers/net/af_packet/rte_eth_af_packet.c +++ b/drivers/net/af_packet/rte_eth_af_packet.c @@ -267,9 +267,16 @@ eth_dev_stop(struct rte_eth_dev *dev) sockfd = internals->rx_queue[i].sockfd; if (sockfd != -1) close(sockfd); - sockfd = internals->tx_queue[i].sockfd; - if (sockfd != -1) - close(sockfd); + + /* Prevent use after free in case tx fd == rx fd */ + if (sockfd != internals->tx_queue[i].sockfd) { + sockfd = internals->tx_queue[i].sockfd; + if (sockfd != -1) + close(sockfd); + } + + internals->rx_queue[i].sockfd = -1; + internals->tx_queue[i].sockfd = -1; } dev->data->dev_link.link_status = ETH_LINK_DOWN; -- 2.20.1