Hi Hillf,
On Mon, Jul 19, 2021 at 7:16 PM Hillf Danton <hdanton@xxxxxxxx> wrote:
>
> On Mon, 19 Jul 2021 17:03:53 +0800 Wang ShaoBo wrote:
> >
> >I have tried this before, this will trigger error "underflow of refcount
> >of chan" as following:
> >
> >[ 118.708179][ T3086] ------------[ cut here ]------------
> >[ 118.710172][ T3086] refcount_t: underflow; use-after-free.
> >[ 118.713391][ T3086] WARNING: CPU: 4 PID: 3086 at lib/refcount.c:28
> >refcount_warn_saturate+0x30a/0x3c0
> >[ 118.716774][ T3086] Modules linked in:
> >[ 118.718279][ T3086] CPU: 4 PID: 3086 Comm: kworker/4:2 Not tainted
> >5.12.0-rc6+ #84
> >[ 118.721005][ T3086] Hardware name: QEMU Standard PC (i440FX + PIIX,
> >1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
> >[ 118.722846][ T3086] Workqueue: events l2cap_chan_timeout
> >[ 118.723786][ T3086] RIP: 0010:refcount_warn_saturate+0x30a/0x3c0
> >...
> >[ 118.737912][ T3086] CR2: 0000000020000040 CR3: 0000000011029000 CR4:
> >00000000000006e0
> >[ 118.739187][ T3086] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
> >0000000000000000
> >[ 118.740451][ T3086] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
> >0000000000000400
> >[ 118.741720][ T3086] Call Trace:
> >[ 118.742262][ T3086] l2cap_sock_close_cb+0x165/0x170
> >[ 118.743124][ T3086] ? l2cap_sock_teardown_cb+0x560/0x560
> >
> >Actually, if adding sock_hold(sk) in l2cap_sock_init(),
> >l2cap_sock_kill() will continue to excute untill it found
> >
> >now chan's refcount is 0, this is because sock was not freed in last
> >round execution of l2cap_sock_kill().
>
> Well double kill cannot be walked around without adding more - add the
> destroy callback to make the chan->data recorded sock survive kill. It
> will be released when chan is destroyed to cut the race in reguards to
> accessing sock by making chan->data stable throughout chan's lifespan.
>
>
> +++ x/net/bluetooth/l2cap_core.c
> @@ -485,7 +485,10 @@ static void l2cap_chan_destroy(struct kr
> list_del(&chan->global_l);
> write_unlock(&chan_list_lock);
>
> - kfree(chan);
> + if (chan->ops && chan->ops->destroy)
> + chan->ops->destroy(chan);
> + else
> + kfree(chan);
While Im fine adding a destroy callback the kfree shall be still in
l2cap_chan_destroy:
if (chan->ops && chan->ops->destroy)
/* Destroy chan->data */
chan->ops->destroy(chan->data);
kfree(chan);
> }
>
> void l2cap_chan_hold(struct l2cap_chan *c)
> +++ x/net/bluetooth/l2cap_sock.c
> @@ -1220,11 +1220,13 @@ static void l2cap_sock_kill(struct sock
>
> BT_DBG("sk %p state %s", sk, state_to_string(sk->sk_state));
>
> + /* double kill means noop */
> + if (sock_flag(sk, SOCK_DEAD))
> + return;
> /* Kill poor orphan */
>
> l2cap_chan_put(l2cap_pi(sk)->chan);
> sock_set_flag(sk, SOCK_DEAD);
> - sock_put(sk);
> }
>
> static int __l2cap_wait_ack(struct sock *sk, struct l2cap_chan *chan)
> @@ -1504,6 +1506,14 @@ done:
> return err;
> }
>
> +static void l2cap_sock_destroy_cb(struct l2cap_chan *chan)
> +{
> + struct sock *sk = chan->data;
> +
> + sock_put(sk);
> + kfree(chan);
> +}
> +
> static void l2cap_sock_close_cb(struct l2cap_chan *chan)
> {
> struct sock *sk = chan->data;
> @@ -1690,6 +1700,7 @@ static const struct l2cap_ops l2cap_chan
> .new_connection = l2cap_sock_new_connection_cb,
> .recv = l2cap_sock_recv_cb,
> .close = l2cap_sock_close_cb,
> + .destroy = l2cap_sock_destroy_cb,
If you do the changes above you can probably have sock_put directly
set as .destroy.
> .teardown = l2cap_sock_teardown_cb,
> .state_change = l2cap_sock_state_change_cb,
> .ready = l2cap_sock_ready_cb,
--
Luiz Augusto von Dentz
