Re: [5.10 CAN BUG report] kernel dump about echo skb

[Vincent MAILHOL <mailhol.vincent@wanadoo.fr>]

On Fri 22 Jan 2021 at 18:40, Oleksij Rempel <o.rempel@pengutronix.de> wrote:
> On Fri, Jan 22, 2021 at 10:23:24AM +0100, Marc Kleine-Budde wrote:
> > On Fri, Jan 22, 2021 at 06:08:18PM +0900, Vincent MAILHOL wrote:
> > > > > 1. Kernel dump log:
> > > > > [  101.688327] ------------[ cut here ]------------ [  101.692968] refcount_t:
> > > > > addition on 0; use-after-free.
> > >
> > > The skb already had its refcount at zero when reaching
> > > can_put_echo_skb(). It is as if it was already freed/consumed!
> >
> > ACK
> >
> > > If you remove Oleksij’s patch, can_put_echo_skb() will probably not
> > > clone the skb and thus not check the refcount: this means that you
> > > will not see the warning, however, it does not necessarily mean that
> > > the bug did not occur.
> >
> > ACK
> >
> > > So far, it seems to me to be another bug which was invisible until
> > > now and which Oleksij’s patch just uncovered. But I do not yet fully
> > > understand what the root cause could be.
> >
> > Or it's the same bug, hitting earlier. Oleksij's backtrace was in the
> > TX-complete path and the problem was fixes by cloning the skb in before TX.
> > This means the refcount of the original skb was decremented between TX and
> > TX-complete. Here the refcount is decremented even before TX.
> >
> > Does this make sense?

Makes absolute sense.

That would mean that Olesij’s patch addressed the issue but too late
and that somewhere earlier in the TX path, the refcount is either:
  - decremented where it shouldn’t be
  - not incremented where it should be

Assuming that the skb reaches the xmit() funcion, what should be its
refcount?
2 if the socket is still opened and 1 if the socket is closed?
Something else?

> Is socket was closed just before TX?

Good question!
In addition, I would like to know which protocol is used (raw_can, j1939,
other?)


Yours sincerely,
Vincent

> Regards,
> Oleksij
> --
> Pengutronix e.K.                           |                             |
> Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
> 31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
> Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |