From: Timmons C. Player Date: Thu, 5 Jan 2017 14:33:35 +0000 (-0500) Subject: net/af_packet: fix fd use after free X-Git-Tag: spdx-start~4840 X-Git-Url: http://git.droids-corp.org/?a=commitdiff_plain;h=5d16a43c40cf2220c1b295307a00cee55d845633;p=dpdk.git net/af_packet: fix fd use after free When using the same file descriptor for both rx and tx, the eth_dev_stop function would close the same fd twice. This change prevents that from happening. Fixes: 364e08f2bbc0 ("af_packet: add PMD for AF_PACKET-based virtual devices") Signed-off-by: Timmons C. Player Acked-by: Ferruh Yigit --- diff --git a/drivers/net/af_packet/rte_eth_af_packet.c b/drivers/net/af_packet/rte_eth_af_packet.c index 17b4ffec89..ed24d385a3 100644 --- a/drivers/net/af_packet/rte_eth_af_packet.c +++ b/drivers/net/af_packet/rte_eth_af_packet.c @@ -267,9 +267,16 @@ eth_dev_stop(struct rte_eth_dev *dev) sockfd = internals->rx_queue[i].sockfd; if (sockfd != -1) close(sockfd); - sockfd = internals->tx_queue[i].sockfd; - if (sockfd != -1) - close(sockfd); + + /* Prevent use after free in case tx fd == rx fd */ + if (sockfd != internals->tx_queue[i].sockfd) { + sockfd = internals->tx_queue[i].sockfd; + if (sockfd != -1) + close(sockfd); + } + + internals->rx_queue[i].sockfd = -1; + internals->tx_queue[i].sockfd = -1; } dev->data->dev_link.link_status = ETH_LINK_DOWN;