Netdev Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Luiz Augusto von Dentz <luiz.dentz@gmail.com>
To: Hillf Danton <hdanton@sina.com>
Cc: "Wangshaobo (bobo)" <bobo.shaobowang@huawei.com>,
	cj.chengjian@huawei.com, Wei Yongjun <weiyongjun1@huawei.com>,
	yuehaibing@huawei.com, huawei.libin@huawei.com,
	Marcel Holtmann <marcel@holtmann.org>,
	Johan Hedberg <johan.hedberg@gmail.com>,
	"linux-bluetooth@vger.kernel.org"
	<linux-bluetooth@vger.kernel.org>,
	"open list:NETWORKING [GENERAL]" <netdev@vger.kernel.org>,
	Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
	syzbot <syzbot+664818c59309176d03ee@syzkaller.appspotmail.com>,
	syzbot <syzbot+9a0875bc1b2ca466b484@syzkaller.appspotmail.com>
Subject: Re: [PATCH v2] Bluetooth: fix use-after-free error in lock_sock_nested()
Date: Mon, 19 Jul 2021 21:24:30 -0700	[thread overview]
Message-ID: <CABBYNZLfFs86Hiej6C2EMVutf4ygyamifBJrXdQK97JpTLBqKg@mail.gmail.com> (raw)
In-Reply-To: <20210720021619.621-1-hdanton@sina.com>

Hi Hillf,

On Mon, Jul 19, 2021 at 7:16 PM Hillf Danton <hdanton@sina.com> wrote:
>
> On Mon, 19 Jul 2021 17:03:53 +0800 Wang ShaoBo wrote:
> >
> >I have tried this before, this will trigger error "underflow of refcount
> >of chan" as following:
> >
> >[  118.708179][ T3086] ------------[ cut here ]------------
> >[  118.710172][ T3086] refcount_t: underflow; use-after-free.
> >[  118.713391][ T3086] WARNING: CPU: 4 PID: 3086 at lib/refcount.c:28
> >refcount_warn_saturate+0x30a/0x3c0
> >[  118.716774][ T3086] Modules linked in:
> >[  118.718279][ T3086] CPU: 4 PID: 3086 Comm: kworker/4:2 Not tainted
> >5.12.0-rc6+ #84
> >[  118.721005][ T3086] Hardware name: QEMU Standard PC (i440FX + PIIX,
> >1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
> >[  118.722846][ T3086] Workqueue: events l2cap_chan_timeout
> >[  118.723786][ T3086] RIP: 0010:refcount_warn_saturate+0x30a/0x3c0
> >...
> >[  118.737912][ T3086] CR2: 0000000020000040 CR3: 0000000011029000 CR4:
> >00000000000006e0
> >[  118.739187][ T3086] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
> >0000000000000000
> >[  118.740451][ T3086] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
> >0000000000000400
> >[  118.741720][ T3086] Call Trace:
> >[  118.742262][ T3086]  l2cap_sock_close_cb+0x165/0x170
> >[  118.743124][ T3086]  ? l2cap_sock_teardown_cb+0x560/0x560
> >
> >Actually, if adding sock_hold(sk) in l2cap_sock_init(),
> >l2cap_sock_kill() will continue to excute untill it found
> >
> >now chan's refcount is 0, this is because sock was not freed in last
> >round execution of l2cap_sock_kill().
>
> Well double kill cannot be walked around without adding more - add the
> destroy callback to make the chan->data recorded sock survive kill. It
> will be released when chan is destroyed to cut the race in reguards to
> accessing sock by making chan->data stable throughout chan's lifespan.
>
>
> +++ x/net/bluetooth/l2cap_core.c
> @@ -485,7 +485,10 @@ static void l2cap_chan_destroy(struct kr
>         list_del(&chan->global_l);
>         write_unlock(&chan_list_lock);
>
> -       kfree(chan);
> +       if (chan->ops && chan->ops->destroy)
> +               chan->ops->destroy(chan);
> +       else
> +               kfree(chan);

While Im fine adding a destroy callback the kfree shall be still in
l2cap_chan_destroy:

if (chan->ops && chan->ops->destroy)
  /* Destroy chan->data */
  chan->ops->destroy(chan->data);

kfree(chan);

>  }
>
>  void l2cap_chan_hold(struct l2cap_chan *c)
> +++ x/net/bluetooth/l2cap_sock.c
> @@ -1220,11 +1220,13 @@ static void l2cap_sock_kill(struct sock
>
>         BT_DBG("sk %p state %s", sk, state_to_string(sk->sk_state));
>
> +       /* double kill means noop */
> +       if (sock_flag(sk, SOCK_DEAD))
> +               return;
>         /* Kill poor orphan */
>
>         l2cap_chan_put(l2cap_pi(sk)->chan);
>         sock_set_flag(sk, SOCK_DEAD);
> -       sock_put(sk);
>  }
>
>  static int __l2cap_wait_ack(struct sock *sk, struct l2cap_chan *chan)
> @@ -1504,6 +1506,14 @@ done:
>         return err;
>  }
>
> +static void l2cap_sock_destroy_cb(struct l2cap_chan *chan)
> +{
> +       struct sock *sk = chan->data;
> +
> +       sock_put(sk);
> +       kfree(chan);
> +}
> +
>  static void l2cap_sock_close_cb(struct l2cap_chan *chan)
>  {
>         struct sock *sk = chan->data;
> @@ -1690,6 +1700,7 @@ static const struct l2cap_ops l2cap_chan
>         .new_connection         = l2cap_sock_new_connection_cb,
>         .recv                   = l2cap_sock_recv_cb,
>         .close                  = l2cap_sock_close_cb,
> +       .destroy                = l2cap_sock_destroy_cb,

If you do the changes above you can probably have sock_put directly
set as .destroy.

>         .teardown               = l2cap_sock_teardown_cb,
>         .state_change           = l2cap_sock_state_change_cb,
>         .ready                  = l2cap_sock_ready_cb,



-- 
Luiz Augusto von Dentz

  parent reply	other threads:[~2021-07-20  4:24 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-07-19  2:49 Wang ShaoBo
     [not found] ` <20210719074829.2554-1-hdanton@sina.com>
2021-07-19  9:03   ` Wangshaobo (bobo)
     [not found]     ` <20210720021619.621-1-hdanton@sina.com>
2021-07-20  4:24       ` Luiz Augusto von Dentz [this message]
     [not found]         ` <20210720062100.819-1-hdanton@sina.com>
2021-07-20 15:46           ` Luiz Augusto von Dentz

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=CABBYNZLfFs86Hiej6C2EMVutf4ygyamifBJrXdQK97JpTLBqKg@mail.gmail.com \
    --to=luiz.dentz@gmail.com \
    --cc=bobo.shaobowang@huawei.com \
    --cc=cj.chengjian@huawei.com \
    --cc=hdanton@sina.com \
    --cc=huawei.libin@huawei.com \
    --cc=johan.hedberg@gmail.com \
    --cc=linux-bluetooth@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=marcel@holtmann.org \
    --cc=netdev@vger.kernel.org \
    --cc=syzbot+664818c59309176d03ee@syzkaller.appspotmail.com \
    --cc=syzbot+9a0875bc1b2ca466b484@syzkaller.appspotmail.com \
    --cc=weiyongjun1@huawei.com \
    --cc=yuehaibing@huawei.com \
    --subject='Re: [PATCH v2] Bluetooth: fix use-after-free error in lock_sock_nested()' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).