From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f49.google.com (mail-wm1-f49.google.com [209.85.128.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EF79E3451CE for ; Thu, 12 Feb 2026 13:40:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.49 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770903661; cv=none; b=TgACaoXEZvfP8VpXcNRX2eeTuLDVoR7F1K3YL1J/O5BiTBMvT+Qf6skIxmIO0+TfceqRxodSrwItZV/LLRPPAr/uBN6ImsJicEB5/yITEPznVZeL0riH8T5qnS+bqoQnDAzl1a+aI2FxJNgTlzWMeGlF1yCGVYsA9TxmQZY3xaY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770903661; c=relaxed/simple; bh=w3t0DMK7E5AB1lyrci1NW1tZ6xExcnLKjjWNzsWrO8I=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=URKNwG9ON55+sMB80AEOm/BDf9k2i7JpMbcEhkW1ZarASsncoaT8kbptexfaXWosCpRyrzuGBJl9OCvVvbCB7/Uxpz2pH2f7kZvnHVeiRYOH/Om9jzNyNUCoSHQ9xc+Y23N+t59AeLQ4pkRGasVvQiROFsA4CXtfTnc021n+kD4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=LiBtEj79; arc=none smtp.client-ip=209.85.128.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="LiBtEj79" Received: by mail-wm1-f49.google.com with SMTP id 5b1f17b1804b1-4801bc32725so49062555e9.0 for ; Thu, 12 Feb 2026 05:40:59 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1770903658; x=1771508458; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=yJVg9Gk08nuxO2aNnlaxDCcb6k/MldzWyDY7N00ZSQk=; b=LiBtEj79xoMJtDLAdqS5gWJrnOyP84/NgkUrZTCwy5CTa7uUOVSLU9A6AHaqUpWc4T jaq8DXmPo00vrwXeG6qxMKbzRk4IHX1i+6K7arTl6nMP7a5GLTIbgFVn0726qNFUOvlx PmcmX55iUmLXQ8L39m/MFnnsXggbkkApKSXPi+1edjTOoTOmDHvoOKEZMb45rpLxArK6 RROhc53L2PR5dPg6HiIACvaehzQmGLT2z3XHw9k24+P4+RDow45HxueVJzbxmo+x8pxv fkf16qZ9XG0dUJcTIjkqBowSKfWzYxLZ10XQey9KAdqpcEepuryG3k5Ts/zBBodkM5t4 +C9g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1770903658; x=1771508458; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=yJVg9Gk08nuxO2aNnlaxDCcb6k/MldzWyDY7N00ZSQk=; b=mqw5LDFxsAZ9MVAARZul8U+vlC4wG0CwLFBiVo0oTYFmv3WJdno1USCAGl3JYk9M0N 2GuD9gBHnRBRFlKpX5qTuISm0FqeoXVzr9b7RqwVJ+mCteVWPd7k5CAhnGaamByv+bwx BJKjCr5v2mZDxQtGx3e17U3DaaJaJGHMEJisJhHnBElMc2VUrOClpqiOiFCbBEJItIm+ 4pZMBnxGF5Aj7zctNZdtD/kB0KDu6+iiDV+Xyam/wWfe1QQcQDEt/YxIlb6dca8HhTvk gEfnw6Iw+2NLoCnN3ePM6DRIXWMoF/2gpHCEomKuE9374011UpQLl/fgGuRq8T7NXxwg meoA== X-Forwarded-Encrypted: i=1; AJvYcCUQe5Y8QYM609tDUTG5pY90bb72OBGrn7ZNJRJe4AQ1/SHMRjpU5ni0FU3o/oY1taoUeJdUxQ4+MXa0VAY=@vger.kernel.org X-Gm-Message-State: AOJu0YzL9B7vCOZETT9TDvhqdKeEZOAfl2bcMMYYOaTCQzvS7nyxeQnO kP3kWhdYrRwnZCS11r3QyfKYsAhZc6Y9ec4ggCed5oM0cJGTpPGkDlv+ X-Gm-Gg: AZuq6aKt8mQ83GSyrIvCigH06vIXmeDTLPnjlaJb3etgF2nCL2v25hmqdIb4rT+tpMj XkhODJ1aRrHb6RvEy+4At448fWWNYgjrmvVfmt/Sj6Q/dseEzYwo7TrRWjXBYDZbqg5Gv3Pe7vx 8mQRQ91wRE0NmAHirSOXY6CYvzm1THsqYREBCzx38Zi1n1JRZVTxvliLVL0fjgqKi4RsYyI+28m LSnQGxcs8hAxf6kwzStlckdwQjV9odKaVjZzhRFfAMovFIkIfhijoYur3FdlOH0hM6GzwcXn/Vi 6jRlFG7e0nUmQJBjHdk4RrJ04wYuxbM0YuwNlofg8nTNOGcmzHfiMx3viXktFQtfxEJswtU4S9m LEdJBvEkxpWrwXsladxpx2VF39Bw2w8OoXdGvAwbe3QJbTDSwagsUNfrkQpNfzAopNmlujFHMt5 FGUcujHGEKtP02h+AZtQ5R4zXE5n+FJC3Ooa9Z2eR+u0oVzNrE+DzSTUEBYwHTidGj6F/m3jyur a8hW+N3+sjbRzU= X-Received: by 2002:a05:600c:3b08:b0:483:885:f0b0 with SMTP id 5b1f17b1804b1-4836571fc70mr44875165e9.35.1770903658096; Thu, 12 Feb 2026 05:40:58 -0800 (PST) Received: from ?IPV6:2a01:4b00:bd1f:f500:e85d:a828:282d:d5c7? ([2a01:4b00:bd1f:f500:e85d:a828:282d:d5c7]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4835dd0deeasm107748385e9.12.2026.02.12.05.40.57 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 12 Feb 2026 05:40:57 -0800 (PST) Message-ID: <1489bda4-6d96-4a44-9486-aa63efcf2307@gmail.com> Date: Thu, 12 Feb 2026 13:40:56 +0000 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH bpf-next v1 08/14] selftests/bpf: Fix use-after-free in xdp_metadata test To: Ihor Solodrai , Alexei Starovoitov , Andrii Nakryiko , Daniel Borkmann , Eduard Zingerman Cc: Amery Hung , Mykyta Yatsenko , =?UTF-8?Q?Alexis_Lothor=C3=A9?= , bpf@vger.kernel.org, linux-kernel@vger.kernel.org, kernel-team@meta.com References: <20260212011356.3266753-1-ihor.solodrai@linux.dev> <20260212011356.3266753-9-ihor.solodrai@linux.dev> Content-Language: en-US From: Mykyta Yatsenko In-Reply-To: <20260212011356.3266753-9-ihor.solodrai@linux.dev> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit On 2/12/26 01:13, Ihor Solodrai wrote: > ASAN reported a use-after-free in close_xsk(). > > The xsk->socket internally references xsk->umem via socket->ctx->umem, > so the socket must be deleted before the umem. Fix the order of > operations in close_xsk(). > > Signed-off-by: Ihor Solodrai > --- > tools/testing/selftests/bpf/prog_tests/xdp_metadata.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/tools/testing/selftests/bpf/prog_tests/xdp_metadata.c b/tools/testing/selftests/bpf/prog_tests/xdp_metadata.c > index 19f92affc2da..5c31054ad4a4 100644 > --- a/tools/testing/selftests/bpf/prog_tests/xdp_metadata.c > +++ b/tools/testing/selftests/bpf/prog_tests/xdp_metadata.c > @@ -126,10 +126,10 @@ static int open_xsk(int ifindex, struct xsk *xsk) > > static void close_xsk(struct xsk *xsk) > { > - if (xsk->umem) > - xsk_umem__delete(xsk->umem); > if (xsk->socket) > xsk_socket__delete(xsk->socket); > + if (xsk->umem) > + xsk_umem__delete(xsk->umem); > munmap(xsk->umem_area, UMEM_SIZE); > } > xsk_umem__delete() is indeed referencing umem, the change makes sense. Acked-by: Mykyta Yatsenko