[dpdk-stable] patch 'net/af_packet: fix fd use after free' has been queued to stable release 16.11.1

[Yuanhan Liu]

Hi,

FYI, your patch has been queued to stable release 16.11.1

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable
yet. It will be pushed if I get no objections before 01/28/17.
So please shout if anyone has objections.

---

Note 16.11 is a LTS release. v16.11.1 is planned to be released
shortly (about 2-3 weeks) after v17.02.

---

Thanks.

	--yliu

---
>From 6aadd6c743b55f04a5a07702851eab64c25b3575 Mon Sep 17 00:00:00 2001
From: "Timmons C. Player" <timmons.player at spirent.com>
Date: Thu, 5 Jan 2017 09:33:35 -0500
Subject: [PATCH] net/af_packet: fix fd use after free

[ upstream commit 5d16a43c40cf2220c1b295307a00cee55d845633 ]

When using the same file descriptor for both rx and tx, the
eth_dev_stop function would close the same fd twice.   This
change prevents that from happening.

Fixes: 364e08f2bbc0 ("af_packet: add PMD for AF_PACKET-based virtual devices")

Signed-off-by: Timmons C. Player <timmons.player at spirent.com>
Acked-by: Ferruh Yigit <ferruh.yigit at intel.com>
---
 drivers/net/af_packet/rte_eth_af_packet.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/drivers/net/af_packet/rte_eth_af_packet.c b/drivers/net/af_packet/rte_eth_af_packet.c
index ff45068..45c6519 100644
--- a/drivers/net/af_packet/rte_eth_af_packet.c
+++ b/drivers/net/af_packet/rte_eth_af_packet.c
@@ -261,9 +261,16 @@ eth_dev_stop(struct rte_eth_dev *dev)
 		sockfd = internals->rx_queue[i].sockfd;
 		if (sockfd != -1)
 			close(sockfd);
-		sockfd = internals->tx_queue[i].sockfd;
-		if (sockfd != -1)
-			close(sockfd);
+
+		/* Prevent use after free in case tx fd == rx fd */
+		if (sockfd != internals->tx_queue[i].sockfd) {
+			sockfd = internals->tx_queue[i].sockfd;
+			if (sockfd != -1)
+				close(sockfd);
+		}
+
+		internals->rx_queue[i].sockfd = -1;
+		internals->tx_queue[i].sockfd = -1;
 	}
 
 	dev->data->dev_link.link_status = ETH_LINK_DOWN;
-- 
1.9.0